Shifting left: How Unified Operations supports financial services industry customers

Introduction

FSI organizations face unique operational challenges driven by stringent regulatory frameworks. These frameworks mandate specific incident management protocols, operational resilience standards, and comprehensive audit trails. Key regulations create a complex compliance landscape that requires specialized approaches to technology infrastructure, risk management, and business continuity planning. These regulations can include:

• Digital Operational Resilience Act (DORA)
• Regulation Systems Compliance and Integrity (Reg SCI)
• MAS Technology Risk Management (TRM)
• APRA CPS 234, PRA/FCA Operational Resilience
• HKMA Technology Risk Management Framework

Critical FSI workloads, including payment processors, trading platforms, and clearing houses, operate under zero-tolerance conditions. For these workloads, even a single minute of downtime can result in millions in losses and regulatory penalties. Regulators classify many of these systems as "systemically important," meaning that their failure could destabilize the broader financial system and necessitate enhanced operational oversight. To address these challenges, FSI firms are modernizing their legacy systems, such as moving mainframes to the cloud. During this transition, the firms must maintain continuous operations and strict regulatory compliance.

Through support from AWS of thousands of FSI migrations, we’ve learned that incorporating cloud operations from the start of the migration journey, or “shifting left,” is a key factor in successful cloud operations. By shifting left, organizations can test, detect, and remediate issues quickly before issues affect a production workload, as seen in Figure 1. This ability is critical to meet regulatory requirements and maintain operational resilience.

Figure 1: Shifting cloud operations left.

Introducing Unified Operations

To address these challenges and move towards shifting cloud operations to the left, AWS launched AWS Unified Operations. Unified Operations is a comprehensive support solution that’s designed specifically for customers with critical workloads, including FSI customers. Unified Operations combines deep technical expertise with FSI-specific knowledge to help customers achieve operational excellence, meet regulatory requirements, and maintain confidence in their cloud operations.

Unified Operations provides the following features to support FSI organizations:

• Context-aware support: Your designated Domain Specialist Engineer (DSE) and Technical Account Manager (TAM) develop deep knowledge of your critical workloads and regulatory context. They provide tailored guidance and support continuous operational improvement, with a focus on resiliency and observability.
• Event planning and support: Migration specialists and AWS Support engineers provide specialized assistance during high-profile events, such as migrations and product launches, to deliver success.
• Proactive monitoring and incident response: Unified Operations delivers 24/7 monitoring and 5-minute response capabilities for the critical workloads for your operations. The service also provides proactive security guidance, automated triaging, and direct access to AWS security experts.
• Continuous improvement: The Critical Workload Review (CWR) process serves as a flywheel mechanism that identifies gaps and risks. Then, you can use the findings to improve availability and performance for your workloads. Senior Billing and Account Specialists (SBAS) serves as dedicated FinOps partners and delivers workload-focused financial management and optimization.

These features create a unified approach that helps FSI customers meet complex regulatory requirements while maintaining the high availability and security that their critical workloads demand.

Supporting FSI challenges

Providing context-aware support

Support teams must understand complex regulatory requirements, workload interdependencies, and FSI-specific architecture patterns, and still manage institutional knowledge across migration and operations phases. Loss of context during transitions can lead to compliance violations and operational disruptions.

Example scenario: A global investment bank migrated their trading platform from on-premises to the AWS Cloud. The bank had multiple teams involved, including migration architects, application developers, database administrators, and operations teams. During the handoff from migration to steady-state operations, critical knowledge about custom database failover procedures and regulatory reporting requirements wasn’t properly documented. When a database issue occurred 3 months post-migration, the operations team lacked context on the workload's specific recovery procedures. This lack of context resulted in extended downtime that initiated a Reg SCI reportable event to the Securities and Exchange Commission (SEC).

How Unified Operations addresses this challenge: Unified Operations provides a designated DSE and TAM to integrate with your teams and provide in-depth knowledge of the AWS services behind your key workloads. They support you from planning, through implementation and testing, to continuous improvement during operations, and provide context-aware support throughout the lifecycle of the workload. The DSE helps document workload-specific knowledge to maintain continuity and compliance audit readiness. The DSE also develops a more structured handoff processes between migration and steady-state operations to prevent knowledge gaps that can lead to regulatory violations.

Event planning and support

FSI migrations must achieve zero-downtime cutover while meeting regulatory approval requirements and maintaining operational resilience throughout the transition. High-stakes events, such as market volatility periods or product launches, require meticulous planning and rapid response capabilities.

Example scenario: A payment processor planned to migrate their card authorization system that processes 50,000 transactions per minute during a weekend maintenance window. However, the processor didn’t adequately test their rollback procedures or establish clear success criteria for the cutover. Midway through the migration, transaction latency spiked to 3 seconds (from a baseline of 200 ms). Without predefined thresholds, the team was unsure of whether to proceed or rollback. The delay resulted in 45 minutes of degraded service during peak shopping hours and affected merchant revenue and customer trust.

How Unified Operations addresses this challenge: Unified Operations supports critical events, such as migration go-live events, market volatility and peak events, product launches, or any other event that requires thoughtful planning and focused support for success. DSEs, along with AWS specialist support engineers, conduct event readiness activities. These activities include operational reviews to identify resiliency and availability risks before the go-live date, definition of success criteria, and customized runbook creation for the event. The DSE works with the AWS specialist support engineers during the critical event for rapid engagement, escalation, and resolution. After the event concludes, specialist support engineers provide post-event analysis and ongoing support to better prepare for future events.

Proactive monitoring and incident response

Regulatory frameworks, such as DORA and Reg SCI, require continuous monitoring, sub-5-minute incident response, and comprehensive incident documentation for systemically important workloads. FSI organizations must maintain robust operational processes to meet customer expectations for continuous service availability and data protection.

Example scenario: A securities clearing house experienced a sudden spike in API error rates at 2:47 AM because of a misconfigured auto-scaling policy. Their internal monitoring system detected the issue at 2:52 AM, but the on-call engineer wasn't paged until 2:58 AM because of alert fatigue from false positives. The engineer then spent 15 minutes diagnosing the root cause before the engineer connected with AWS Support at 3:13 AM. By the time the engineer contacted AWS specialists and the issue resolved, 30 minutes had elapsed. The organization exceeded their Reg SCI requirement for a 15-minute incident response. The delayed response required a formal regulatory filing and initiated an internal audit.

How Unified Operations addresses this challenge: Unified Operations addresses these challenges through comprehensive 24/7 monitoring and proactive incident management. The Unified Operations team helps customers identify key workload metrics to monitor and the thresholds to initiate an alarm. The Unified Operations team also creates custom response plans, or runbooks, for those alarms. The AWS Incident Management team engages within 5 minutes when a critical alarm occurs. The team then uses the context provided in the custom runbooks to efficiently engage the proper resources from the customer and AWS teams. The AWS Incident Management team has direct access to AWS experts for rapid escalation, and minimizes disruption for a faster resolution. After the team resolves an incident, the team provides an incident summary report for regulatory compliance and audit purposes. The Incident Management team works with the DSE to review improvements to workload observability and response procedures, with the goal to prevent future disruptions and increase operational resiliency.

In addition, Unified Operations provides monitoring, triage, and investigation of security findings. The service uses AWS Security Hub to consolidate security alerts from Amazon GuardDuty, Amazon Inspector, Amazon Macie, and popular third-party threat detection tools. Unified Operations uses automation through AWS Security Incident Response and customer-specific information to filter vital security findings. This reduces the operational burden on security teams so that they can focus on higher-priority work. When a security event is detected or reported, the AWS Customer Incident Response Team (CIRT) is notified and they deploy automated actions for containment and remediation.

Continuous improvement

FSI firms must continuously demonstrate operational resilience improvements to regulators while optimizing costs and maintaining service quality. This challenge requires structured assessment processes and ongoing optimization that aligns with AWS best practices and regulatory requirements.

Example scenario: A retail bank's mobile banking application experienced three separate outages over 6 months, each caused by different issues:

• Database connection pool exhaustion
• Insufficient Amazon Elastic Compute Cloud (Amazon EC2) capacity during peak hours
• A third-party API failure with no circuit breaker

While the bank resolved each incident, there wasn’t any systematic process to identify common architectural weaknesses or implement preventive measures. During their annual DORA compliance review, auditors cited the lack of continuous improvement processes as a concern. The auditors required the bank to demonstrate how they would prevent similar incidents in the future. Without a structured approach to operational resilience reviews, the bank struggled to provide adequate evidence of ongoing improvements.

How Unified Operations addresses this challenge: Multiple Unified Operations roles contribute to continuous improvement through a structured approach to workload assessment. The CWR process is a comprehensive two-phase process designed to maintain optimal workload performance and resilience. In Phase 1, the DSE conducts detailed service-level analysis across key pillars, including resiliency and observability, for the underlying AWS services. In Phase 2, the TAM performs a holistic workload resiliency review that examines the entire workload ecosystem and interdependencies. Beyond the formal CWR process, the DSE also meets with you regularly to review workload changes and discuss any issues. During these ongoing meetings, AWS provides optimization recommendations to help you align your AWS environment with established best practices and regulatory requirements. An SBAS focuses on cost optimization and billing efficiency and provides recommendations to reduce your bill and maximize value. The Incident Management Engineers (IMEs) that manage Incident Response update customer-specific runbooks with learnings from remediated incidents so that you can resolve or avoid future incidents.

Actual customer stories

Unified Operations is in use by FSI customers today. The following are a few examples of the real improvements from Unified Operations subscribers.

Migrations

An FSI payments customer used Unified Operations to migrate their marquee. This process involved four sub-workloads developed by AWS Professional Services, an AWS Partner, and the customer. As these teams developed the workloads, the DSE and TAMs conducted in-depth workload reviews. These reviews consisted of 4 critical workload reviews, provided 20 operational enhancements, and identified 59 critical signals for the workloads. Through a deep dive, the DSE and TAMs identified two critical resiliency and availability risks that the payments customer mitigated before the go-live date. This mitigation prevented potential regulatory violations and service disruptions. After the deployment, the customer integrated the critical signals found during the review with Unified Operations and receives proactive monitoring and enhanced incident management capabilities.

Production workloads

Unified Operations delivered transformational support to a major financial services issuer and helped the issuer transition from mainframe systems. Since implementation of Unified Operations, the customer achieved significant operational improvements, including reduction of Mean Time to Recovery (MTTR) from 15 minutes to under 2 minutes for their multi-Region credit card processing systems. This dramatic improvement allowed the issuer to successfully migrate their first major client's digital API workload from mainframe to AWS. During the migration, the issuer also met zero-downtime requirements and enhanced system observability through business and platform KPI alarms. The proactive engagement model empowered the customer to strengthen their operational support framework and demonstrate improved incident response capabilities to their own clients and regulators. The organization also successfully migrated from Confluent Kafka to Amazon Managed Streaming for Apache Kafka (Amazon MSK) for improved cost optimization and resiliency. The CWR capability helped identify architectural improvements ahead of time, while Unified Operations support for their databases maintained zero-downtime production releases. These capabilities provided the customer the confidence to accelerate their AWS product offerings with enhanced operational excellence.

Enterprise enablement

A Systemically Important Financial Market Utility (SIFMU) organization processes 48 million options contracts daily and plays a critical role in US financial system stability. As the first SIFMU organization to seek cloud migration approval, they faced stringent regulatory oversight and zero-downtime requirements. Unified Operations augments the customer's existing incident management process to reduce MTTR for service-impacting events. Unified Operations also introduces active monitoring by the Unified Operations team and a 5-minute response time when a threshold breach occurs to meet regulatory requirements. After incident resolution, the Unified Operations DSE provides guidance on architectural improvements to enhance the resiliency of their workloads and mitigate the risk of future interruptions.

By mid-2026, the SIFMU organization will launch their next-generation platform on AWS, incorporating guidance from the Unified Operations team. This migration represents a landmark shift in how critical financial infrastructure leverages cloud technology to set a precedent for the industry. As they prepare for this launch, they have access to specialist engineers to review their proposed architecture and identify gaps. These specialist engineers also help them align with best practices and point out potential pitfalls before they derail the project. These capabilities all help support a successful go-live event that meets regulatory approval requirements.

Next steps toward operational excellence

Unified Operations offers enhanced support to FSI customers migrating to or operating in AWS. This support spans all stages of the workload lifecycle, from planning, development, and testing to migration and steady-state operation. The integrated capabilities help FSI customers meet regulatory requirements, such as DORA and Reg SCI. They also enhance resiliency and drive continuous operations improvements to meet the challenges of constantly evolving competitive and regulatory landscapes.

To learn more about how Unified Operations can help your organization achieve operations excellence and meet FSI regulatory requirements, contact your AWS account team or visit AWS Support. A Unified Operations specialist can review your current operational model and regulatory requirements to show you how you can use Unified Operations to meet your organization's cloud operation needs.

About the authors

Shataksh Sharma

Shataksh Sharma is a Principal TAM at AWS. He specializes in cloud resiliency and cloud operations. He also works closely with strategic AWS FSI customers to build out services such as Unified Operations and AWS Incident Detection and Response.

Anish Sheth

Anish Sheth is a Senior Solutions Architect at AWS who helps customers establish secure and operational cloud foundations. He’s passionate about solving customer operational and security challenges to move them forward in their cloud adoption journey.

Michael Dobson

Michael is a Senior TAM at AWS who works with global FSI customers. He specializes in technical operations and information security, and enjoys providing strategic guidance to Enterprise Support customers as they move to and operate within AWS.