Internet banking for a state-owned bank

Context

Agrani Bank PLC is one of Bangladesh's state-owned banks. Celloscope built its Internet Banking platform: iOS, Android and web for individuals, SMEs and corporates. The platform launched publicly in March 2022 and was delivered in about a month, with the T24 core banking integration finished in about a week through Celloscope's CBS middleware. A later deployment for Bangladesh Krishi Bank, on a different core, proved the architecture was core-agnostic.

Constraint

Bank-hosted infrastructure, no cloud. Every deployment and every incident happened inside the bank's data centre with the bank's IT staff watching. The security posture had to satisfy a state bank from day one. And the payment rails were many: BEFTN batch transfers, NPSB real-time transfers, mobile wallets (bKash, Nagad, Upay), QR payments and cash-out, ekpay, telco recharge, and Election Commission eKYC with OCR, face match and liveness.

What I owned

I joined as a backend Java developer on the Spring Boot services. Within the first year I became the engineer who faced the bank: gathering requirements from its senior IT staff, translating them for the team, and being physically present for deployments and infrastructure incidents until a dedicated DevOps team was formed. I owned the test strategy, with JUnit and Mockito unit and integration suites plus regression coverage for payment flows, and ran delivery in Jira: sprints, grooming and release-readiness reviews.

Architecture

Decisions and trade-offs

• One seam for the core bank. Every T24 call went through the CBS middleware, so the second bank on a different core reused the platform unchanged.
• Feature flags for bank-hosted releases. With no cloud and no easy rollback, flags let us ship dark and enable per cohort. Zero-downtime releases on the bank's own servers.
• Security before features. OAuth2 PKCE for the apps, MFA, RBAC, mTLS between services, secrets in HashiCorp Vault, encryption at rest and in transit. The bank's audits were easier because the posture existed from sprint one.
• Be in the room. Standing next to the bank's operations team during deployments cost evenings. It also built the trust that made every later requirements conversation faster.

Outcome

• 583K+customers, March 2022 to May 2026
• $1.8BBDT 212.5B in transactions processed
• 23.2Mlogins in 2025
• 120+ TPSsustained, with 20.9x growth in transaction value from launch year to the 2025 peak

Stack

Java, Spring Boot, Spring Security, PostgreSQL, Redis, Angular, GitLab CI/CD, Docker, feature flags, Prometheus, Grafana, centralized logging, JUnit, Mockito, HashiCorp Vault, Jira.