A compliance migration. Every single requirement — MiFID II, Basel II, IT security — had to be described in detail: what we solve how. Every change had to be documented, because the supervisory authority later audits exactly this documentation. It wasn't enough to satisfy the function — we had to be able to explain in every audit why precisely this solution path and not another. This continuous burden of justification is the actual cost-and-time factor in a banking platform migration. Whoever doesn't have it in the project rhythm from the start never catches up.
A codetermination migration. Voice recording of 1,200 employees is not a purely technical matter; it is a hard codetermination issue. The works council was completely opposed to recording at the start — interestingly, not against recording itself, since its regulatory necessity was beyond doubt. What disturbed the works council was the manual effort for downstream classification of the recordings by employees: which securities had been discussed in which call? Answering that question only afterwards is error-prone — and the employee burden it generates was unacceptable to the works council.
An AI that could automatically classify recordings did not exist at this maturity in 2016.
We solved the problem at a different point: with a metadata system at the trading desk that allowed the trader to enter the securities IDs (WKN) during the call. Data is generated where it is already known — not reconstructed afterwards from memory. With that, the manual post-processing went away, the regulatory requirement was met, and the employee no longer had to spend hours at the end of the week classifying recordings he had known about while making the call.
That was the moment the works council could carry the solution.
The second pillar of the codetermination architecture was access to recording data. Except when the supervisory authority requested data, every access was strictly under two-person principle. Each individual access had to be presented to the works council with justification. This discipline is built into the system, not appended — which means it cannot be bypassed under time pressure, even with good intent.
A trading migration. Switching ten trading desks under 99.99% high availability across two sites while ongoing trading cannot be paused is the operationally most delicate of the three migrations. Switch-over tests, failover behaviour, recording continuity, timestamp accuracy — all under the pressure that a gap in the recording is more expensive in an audit than the migration itself.
A central key person on the bank side was the chief security officer. In a constellation where compliance, codetermination and trading continuity can pull against each other, the CSO's voice is often the one that decides which solution is forensically sound in case of doubt. Bringing that voice in early, honestly and in detail kept the project from looping multiple times.