ZTABS modernizes legacy applications for London enterprises — migrating COBOL mainframes, AS/400 systems, and .NET monoliths to cloud-native architecture with zero-downtime transitions and FCA/PRA compliance maintained throughout.
Legacy application modernization in London addresses the accumulated technology debt of one of the world's oldest financial centres — a city where Lloyd's of London still processes specialty insurance through systems designed in the 1980s, where NHS trusts run patient administration on platforms that predate the internet, and where the Bank of England oversees institutions running COBOL codebases written before many of their current employees were born. London's legacy modernization challenge is unique in its scale, complexity, and regulatory overlay. FCA/PRA operational resilience — the FCA's PS21/3 and PRA's PS6/21 on operational resilience require financial firms to identify their Important Business Services, set impact tolerances, and demonstrate they can remain within those tolerances during severe but plausible disruption scenarios. Legacy systems that cannot meet operational resilience requirements create regulatory risk — firms have until March 2025 to demonstrate full compliance, creating urgent modernization demand. The PRA's SS2/21 specifically addresses outsourcing and third-party risk, requiring firms to manage technology dependencies with board-level governance. DORA (Digital Operational Resilience Act) adds EU-derived requirements for UK firms with European operations — ICT risk management, incident reporting, and third-party risk governance that legacy systems struggle to support. Lloyd's Blueprint Two — Lloyd's Corporation's modernization programme requires managing agents to submit structured data through the Core Data Record and adopt digital processes. Managing agents running claims, underwriting, and bordereaux processing on AS/400 and legacy mainframe systems face a Blueprint Two compliance deadline that forces modernization. NHS digital transformation — NHS England's programme to digitize patient services runs into the reality that many NHS trusts operate patient administration systems (PAS) from the 1990s, pathology systems on ageing platforms, and clinical systems that cannot integrate with modern digital health infrastructure. The NHS Long Term Plan sets digital maturity targets that legacy systems cannot meet. Post-Brexit regulatory divergence — UK financial services regulation is diverging from EU standards (Edinburgh Reforms, Mansion House Compact), creating requirements for technology flexibility that rigid legacy systems cannot accommodate. Firms need modern, configurable platforms that can adapt to UK-specific regulatory changes without the 12-18 month development cycles that legacy modifications require.
London's legacy modernization demand spans five sectors. Financial services — the City's defining legacy challenge. Retail and commercial banking: UK's major banks (Barclays, NatWest, HSBC, Lloyds Banking Group) running core banking systems that are 30-40 years old. Barclays' core banking still runs on IBM mainframes processing 2.3 billion transactions annually — a system that works reliably but cannot support real-time payments, open banking APIs, or the personalisation capabilities that challenger banks (Monzo, Starling, Revolut) deliver natively. NatWest's mainframe modernization programme (estimated GBP 3B+ investment) demonstrates the scale of UK bank modernization. The Competition and Markets Authority's Open Banking mandate requires banks to expose APIs — which legacy core banking systems were never designed to support, creating an integration layer of increasing complexity and fragility. Lloyd's of London: 50+ managing agents running underwriting, claims, and accounting on legacy platforms. Many managing agents use AS/400-based policy administration systems (Sequel, Open GI legacy versions) and COBOL-based accounting systems. Blueprint Two requires these agents to submit structured data and integrate with Lloyd's central services — forcing modernization of systems that have been stable for decades. Building societies: Nationwide, Yorkshire, Coventry, and other building societies running mortgage origination and savings platforms on legacy infrastructure. Building societies face particular modernization pressure from the FCA's Consumer Duty (PS22/9), which requires firms to demonstrate that their products deliver good outcomes — requiring data analysis capabilities that legacy systems cannot provide. Payment processors: legacy payment systems processing billions in transactions through SWIFT messaging, BACS, CHAPS, and Faster Payments — each requiring specific message formatting and processing rules that legacy systems handle reliably but inflexibly. Healthcare — NHS legacy systems. Patient Administration Systems: many London NHS trusts running PAS platforms from vendors like iSoft (now part of DXC), Cerner legacy installations, or bespoke systems developed in the 1990s. These systems manage patient demographics, appointments, bed management, and discharge — critical functions that cannot tolerate downtime. Trust integration: NHS mergers (creating larger trust groups) expose the challenge of integrating legacy systems across sites — Guy's and St Thomas' merging patient records across hospitals running different legacy platforms, requiring modernization to achieve single patient views. Pathology and diagnostics: legacy LIMS (Laboratory Information Management Systems) running on platforms that vendors no longer support — creating both functionality limitations and security vulnerabilities. Government — Whitehall legacy systems. HMRC: operates some of the UK's largest legacy systems — the tax calculation and collection infrastructure processing GBP 700B+ annually, much of it running on systems designed in the 1980s. HMRC's Digital First programme drives modernization, but the complexity of UK tax law encoded in legacy systems makes replacement extraordinarily complex. DWP (Department for Work and Pensions): operates legacy benefits processing systems handling Universal Credit, State Pension, and legacy benefits (ESA, JSA) — systems that process payments for 20 million people. The complexity of benefits calculation rules encoded over decades makes modernization a multi-year, multi-billion-pound undertaking. Ministry of Defence: operating legacy logistics, personnel, and command systems — some running on platforms that are no longer commercially supported, creating security and operational risks. Insurance — London Market legacy. Commercial insurers: Aviva, Legal & General, Admiral, Direct Line — running policy administration, claims, and pricing on legacy platforms. Solvency II reporting requirements demand data extraction from systems never designed for regulatory analytics. Specialty insurers: Hiscox, Beazley, Lancashire — running bespoke underwriting systems built over decades that encode specialist underwriting knowledge but cannot integrate with modern data analytics, digital distribution, or regulatory reporting platforms. Legal — UK law firm legacy. Magic Circle and Silver Circle firms running practice management, document management, and time recording on legacy platforms. Law firm mergers (Allen & Overy and Shearman & Sterling creating A&O Shearman) expose legacy system integration challenges — firms needing to merge client databases, conflict checking systems, and billing platforms running on incompatible legacy infrastructure.
Our London legacy modernization methodology addresses UK regulatory requirements and the zero-downtime imperatives of financial services and healthcare. Phase 1 — Legacy Assessment and Regulatory Mapping (weeks 1-3): comprehensive inventory of legacy systems, data flows, and dependencies. Regulatory mapping: which systems support FCA Important Business Services, which process PRA-regulated data, which fall under NHS DSPT requirements. Technical debt assessment: code analysis, dependency mapping, and infrastructure evaluation. Phase 2 — Modernization Strategy (weeks 3-5): selecting the right approach for each system — strangler fig pattern (gradually replacing legacy with modern microservices), lift-and-shift (moving to cloud with minimal modification for quick wins), re-platform (modernizing the platform while preserving business logic), or full re-architecture (rebuilding from scratch when legacy is too complex to migrate). Phase 3 — Parallel Running (weeks 5-16+): building modern replacements alongside legacy systems, running both in parallel to validate correctness. For financial services: transaction-level reconciliation between legacy and modern systems before cutover. For healthcare: patient safety validation ensuring no clinical data is lost or corrupted. Phase 4 — Progressive Cutover (weeks 12-24+): migrating users, data, and integrations progressively — never a big-bang cutover for critical systems. Rollback capability maintained at every stage.
Insurance / Lloyd's Market / Legacy Modernization / London
A London Lloyd's managing agent (GBP 1.8B gross written premium across 3 syndicates, specialising in marine, energy, and political risk, 280 employees, offices in the Lloyd's building and Leadenhall Street) needed to modernize their core technology stack to meet Lloyd's Blueprint Two requirements and FCA operational resilience obligations. The managing agent's technology estate was typical of mid-sized Lloyd's market participants: built over 25 years through organic growth, acquisitions, and tactical fixes rather than strategic architecture. Core systems: policy administration — a heavily customised AS/400-based system (originally deployed in 1998, written in RPG/400 and CL) managing 42,000 active policies across marine hull, marine cargo, energy upstream, energy downstream, political violence, and terrorism lines. The system had been modified by 8 different developers over 25 years — 1.2 million lines of RPG code, 340 database files, and 2,800 programme objects, with minimal documentation and no automated tests. Only 2 employees (both over 55) fully understood the system's business logic. Claims — a separate AS/400 application (deployed 2001) managing claims across all syndicates. The claims system interfaced with the policy system through a nightly batch process — meaning claims handlers could not see real-time policy data during the business day. Claims data was reconciled with Lloyd's central services (Xchanging, now DXC) through manual file exchanges. Accounting — a COBOL-based general ledger (originally deployed 1996 on an IBM System/36, migrated to AS/400 in 2004) managing syndicate accounting, trust fund management, and regulatory reporting. The accounting system processed GBP 1.8B in premium and GBP 1.2B in claims payments annually, interfacing with Lloyd's central accounting through LPAN (Lloyd's Premium Accounting Network). Bordereaux processing — a collection of Microsoft Access databases and Excel spreadsheets (built 2008-2015) processing delegated authority bordereaux from 85 binding authority holders worldwide. Bordereaux arrived in inconsistent formats and required manual manipulation before data could be entered into the policy and claims systems. Specific challenges: (1) Blueprint Two compliance gap — Lloyd's Blueprint Two required structured data submission through the Core Data Record (CDR), digital placement support, and modern API integration with Lloyd's central services. The managing agent's AS/400 systems could not: generate CDR-compliant data extracts (the data model did not map to CDR schema without extensive transformation), integrate with Lloyd's APIs (AS/400 had no native REST API capability — all integration was file-based), or support digital placement (the underwriting process relied on paper slips and manual data entry into the AS/400 after binding). The CDR compliance deadline created a hard modernization deadline. (2) Operational resilience failure — the FCA required the managing agent to identify Important Business Services and demonstrate they could operate within impact tolerances during disruption. The managing agent's Important Business Services (policy binding, claims payment, regulatory reporting) all depended on the AS/400 systems, which had: single points of failure (one physical AS/400 server with no real-time replication — DR was nightly tape backup with 24-hour RTO, far exceeding the 4-hour impact tolerance set for claims payment), no horizontal scaling (peak periods like 1 January renewals caused system slowdowns — the AS/400 had fixed processing capacity), and vendor end-of-life concerns (IBM AS/400/iSeries support becoming increasingly limited, with replacement parts and specialist skills increasingly scarce). (3) Knowledge concentration risk — the 2 employees who understood the AS/400 systems were both planning retirement within 3 years. The managing agent had attempted to hire AS/400/RPG developers but found it nearly impossible — the skill set was rare and concentrated among developers over 50. Without modernization, the managing agent faced a scenario where their core systems would become unmaintainable. (4) Data silos — each system held a partial view of reality. Policy data in the AS/400 policy system, claims data in the AS/400 claims system, financial data in the COBOL accounting system, and bordereaux data in Access databases — with no unified view. Answering basic questions like "what is our total exposure to Ukrainian political risk across all syndicates?" required manual data extraction from 4 systems, typically taking 2-3 days. Blueprint Two and operational resilience both required real-time, unified data visibility that the fragmented legacy estate could not provide. (5) Integration fragility — the systems were connected through batch processes, file transfers, and manual rekeying. Policy-to-claims: nightly batch extract. Claims-to-accounting: weekly batch reconciliation. Bordereaux-to-policy: manual entry from Access databases. All-to-Lloyd's: manual file exchange with Lloyd's central services. Any process failure required manual intervention — and the batch-based architecture meant errors were discovered the following day at the earliest, creating reconciliation backlogs that consumed significant staff time.
We delivered a complete legacy modernization over 38 weeks — replacing the AS/400 and COBOL estate with a modern, cloud-native platform while maintaining zero-downtime operations throughout the transition. (1) Knowledge extraction: capturing 25 years of business logic. Before writing any new code, we spent 6 weeks extracting business logic from the legacy systems — working with the 2 senior AS/400 developers (treating this as a knowledge capture engagement, not a technology project). RPG code analysis: automated static analysis of 1.2 million lines of RPG/400 code, identifying 4,200 distinct business rules (premium calculations, coverage validations, claims reserving logic, regulatory calculations). Each rule documented with: the RPG code implementing it, the business purpose (validated with underwriters and claims handlers), test cases (input/output examples from production data), and edge cases (special handling for unusual scenarios discovered through code analysis). Database analysis: mapping 340 AS/400 database files (DB2/400) to a modern data model — identifying which fields were actively used (only 62 percent — 38 percent of fields had not been updated in over 3 years), which tables had implicit relationships (AS/400 systems often used naming conventions rather than foreign keys), and which data quality issues existed (inconsistent formatting, duplicate records, orphaned references). COBOL extraction: similar analysis of the accounting system — extracting trust fund calculation logic, Lloyd's settlement processing rules, and regulatory reporting calculations from COBOL source code. Interview-based capture: 24 structured sessions with the 2 AS/400 developers, underwriters, and claims handlers — capturing tacit knowledge that existed only in people's heads. "When a marine hull claim exceeds the layer limit but the endorsement hasn't been processed yet, you have to manually adjust the reserve in the claims system and put a note in the comments field so the accounting batch picks it up correctly" — this type of undocumented workaround was critical to capture. (2) Modern platform architecture: cloud-native Lloyd's market system. Technology stack: the replacement platform built on: Kubernetes (AWS EKS) for container orchestration, TypeScript/Node.js for API services (18 microservices), PostgreSQL for relational data (replacing DB2/400 and COBOL flat files), event-driven architecture (AWS EventBridge) replacing batch processes with real-time event streaming, React frontend replacing green-screen terminals, and API gateway (Kong) providing REST APIs for Lloyd's Blueprint Two integration. Microservice decomposition: the monolithic AS/400 system decomposed into 18 bounded microservices: policy management (risk capture, endorsement processing, renewal management), underwriting (pricing, referral workflows, authority management), claims (FNOL, reserve management, settlement, recovery), bordereaux (ingestion, validation, processing, monitoring), accounting (trust fund management, settlement, regulatory reporting), reporting (syndicate reporting, Lloyd's CDR generation, regulatory returns), and integration services (Lloyd's central services, broker systems, third-party data). Each microservice independently deployable, scalable, and maintainable — addressing the single-point-of-failure concern and enabling the managing agent to evolve individual components without system-wide risk. (3) Strangler fig migration: zero-downtime transition. Rather than a big-bang replacement (which would have been impossibly risky for a system processing GBP 1.8B in premium), we used the strangler fig pattern — gradually routing functionality from legacy to modern while both systems ran in parallel. Migration sequence (ordered by risk and Blueprint Two priority): Phase A — bordereaux processing (weeks 8-14): the lowest-risk, highest-pain-point migration. Replacing Access databases with a modern bordereaux ingestion service that: automatically parsed 85 different bordereaux formats (CSV, Excel, PDF — using configurable parsing rules), validated data against binding authority terms (flagging entries outside authority limits), and fed validated data directly into the policy management service (eliminating manual rekeying). Bordereaux processing time: from 3 days manual to 4 hours automated (85 percent reduction). Phase B — claims (weeks 12-20): migrating claims processing from AS/400 to modern platform. Real-time policy data access (replacing nightly batch), automated Lloyd's central services integration (replacing manual file exchange), and real-time reserve tracking with audit trail. During parallel running: every claim processed through both legacy and modern systems, with automated reconciliation confirming identical outcomes before legacy was decommissioned. Phase C — policy administration (weeks 16-28): the most complex migration — moving 42,000 active policies and all underwriting workflows. Data migration: 340 legacy database files mapped to modern schema, with data quality remediation (deduplication, format standardisation, orphan cleanup). 4,200 business rules reimplemented in the modern platform, with automated regression testing against legacy system outputs (1.2 million test cases run nightly comparing legacy and modern results). Phase D — accounting (weeks 24-34): migrating the COBOL general ledger to modern accounting services. Trust fund calculations validated against Lloyd's central accounting. Regulatory reporting (PRA returns, Lloyd's syndicate returns) validated against prior submissions. Phase E — decommission legacy (weeks 34-38): legacy systems decommissioned only after 4 weeks of modern-only operation with zero issues. AS/400 data archived in read-only format for 7-year regulatory retention. (4) Blueprint Two compliance: CDR and digital integration. CDR generation: the modern platform generating Lloyd's Core Data Record submissions directly from policy and claims data — 132 required fields populated automatically with 98.4 percent accuracy (exceeding Lloyd's 95 percent target). API integration: REST APIs enabling digital placement, broker integration, and Lloyd's central services connectivity — capabilities impossible on the legacy AS/400. Real-time data: unified data model enabling instant answers to exposure queries ("total Ukrainian political risk exposure" answerable in seconds, not days). (5) Operational resilience: exceeding FCA requirements. Multi-AZ deployment: AWS EKS cluster spanning 3 availability zones — eliminating single points of failure. RTO: from 24 hours (tape backup) to 15 minutes (automated failover). RPO: from 24 hours (nightly backup) to near-zero (real-time database replication). Auto-scaling: Kubernetes horizontal pod autoscaler handling 1 January renewal peak loads without performance degradation — system automatically provisioning additional capacity during peak periods. Disaster recovery: tested quarterly with full failover exercise — demonstrated to FCA during supervisory assessment.
Results over 12 months post-modernization. Blueprint Two compliance: CDR submission accuracy: 98.4 percent (exceeding 95 percent target — the managing agent recognised as a "digitisation leader" by Lloyd's). Digital placement capability: 34 percent of new risks now placed digitally (from 0 percent). API integration with 6 Lloyd's central services (from 0 — all previously manual file exchange). Lloyd's market recognition: invited to present modernization approach to other managing agents. Operational resilience: RTO from 24 hours to 15 minutes. RPO from 24 hours to near-zero. FCA assessment: operational resilience requirements fully met — no supervisory findings. 1 January renewal season: zero system performance issues (versus 3 days of degraded performance in prior year on AS/400). Processing efficiency: bordereaux processing: from 3 days to 4 hours (85 percent reduction). Claims processing: average claim lifecycle from 14 days to 6 days (57 percent reduction). Policy endorsement processing: from 48 hours to 2 hours (96 percent reduction). Real-time exposure reporting: from 2-3 days manual to instant queries. Staff redeployment: 8 FTE previously dedicated to manual data processing, reconciliation, and legacy system workarounds redeployed to underwriting analysis, client relationship management, and claims negotiation — higher-value activities. Knowledge risk eliminated: system no longer dependent on 2 retiring employees. Modern technology stack (TypeScript, React, PostgreSQL, Kubernetes) attracting younger developers — 6 new technology hires in first year post-modernization (versus 0 successful hires in 3 prior years for AS/400 skills). Technology cost: AS/400 infrastructure (hardware maintenance, IBM licences, specialist support): GBP 480K annually — eliminated. Modern platform (AWS infrastructure, SaaS licences): GBP 220K annually. Annual infrastructure saving: GBP 260K. Development velocity: new feature deployment from 6-8 weeks (legacy change cycle with regression testing) to continuous deployment (multiple releases per week). Regulatory change implementation: from 3-6 months to 2-4 weeks. Total modernization investment: GBP 2.8M (ZTABS engagement + internal team + AWS costs over 38 weeks). Annual operational savings: GBP 1.4M (infrastructure savings + staff redeployment value + processing efficiency). Payback period: 24 months. 5-year TCO reduction: estimated GBP 4.2M.
Modernize one module at a time — reducing risk, delivering value early, and keeping the business running throughout.
We extract and document the business rules embedded in legacy code so nothing gets lost in the new system.
Migrate from legacy databases (Access, FoxPro, SQL Server) to modern PostgreSQL or cloud-managed databases.
Build modern REST or GraphQL APIs that let the new system talk to legacy components during the transition period.
Create comprehensive test suites that verify the new system behaves identically to the old one for every critical workflow.
Deploy the modernized application on AWS, Azure, or Vercel with CI/CD pipelines, monitoring, and auto-scaling.
London's legacy modernization market includes major systems integrators (Accenture, TCS, Infosys — large-scale capability but GBP 5M+ engagement minimums and often overly complex delivery approaches), Lloyd's market technology specialists (Sequel, Uncharted — domain knowledge but legacy technology themselves), niche modernization firms (COBOL-to-Java conversion shops — technical migration but often missing business context), and cloud provider professional services (AWS, Azure — infrastructure expertise but lacking insurance/financial services domain knowledge). ZTABS delivers London legacy modernization with genuine domain expertise — understanding Lloyd's market conventions, FCA/PRA regulatory requirements, and NHS data standards — combined with modern cloud-native engineering.
Legacy modernization in London ranges from GBP 400K-1.2M for focused modernizations (single system replacement — bordereaux processing, claims, or accounting) to GBP 1.5M-4M for comprehensive legacy estate replacement (full AS/400 or mainframe migration with parallel running). Ongoing managed services: GBP 15K-35K monthly for platform operations and continuous improvement. Lloyd's market engagements include Blueprint Two compliance. NHS trust engagements include DSPT compliance and clinical safety validation.
Verified reviews from real client engagements — sourced from our public testimonial archive and Clutch profile.
My experience is throughout positive. Communication, service, the short response times and the flawless execution of a challenging topic was absolutely great. ZTABS is definitely my first choice again.
Christian Neff
Bank Software Advisory · Bank Software Advisory
Fintech
Fantastic Agency! I couldn't fault them even if I tried. They always go above and beyond to meet your expectations and always produces quality work. Thank you ZTABS.
Stephanie Kal
CEO · Beauty Finder Australia
Marketplace
It has been great working with ZTABS. They bounce off the ideas along the way. Amazing Experience.
Joel Rowe
CEO · Drill Quoter
Marketplace
We don't just contract. We ship and operate our own software. 23 products in production.
Common questions about legacy app modernization for London businesses
The strangler fig pattern — building modern microservices alongside legacy, migrating functionality progressively with parallel running and automated reconciliation. Our managing agent migrated over 38 weeks with zero downtime. Every claim and policy processed through both systems during transition to validate correctness before legacy decommission.
ZTABS is a remote-first legacy app modernization agency serving Houston businesses — including incremental modernization, business logic preservation, data migration. We work with Energy & Oil/Gas, Healthcare & Biotech, Aerospace & Defense companies in Houston, TX via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Legacy App Modernization in New York, NYZTABS is a remote-first legacy app modernization agency serving New York businesses — including incremental modernization, business logic preservation, data migration. We work with Finance & Fintech, Media & Advertising, Fashion & Retail companies in New York, NY via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Legacy App Modernization in Los Angeles, CAZTABS is a remote-first legacy app modernization agency serving Los Angeles businesses — including incremental modernization, business logic preservation, data migration. We work with Entertainment & Media, E-commerce & DTC Brands, Gaming & AR/VR companies in Los Angeles, CA via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Development in London, United KingdomZTABS is a remote-first web development agency serving London businesses — including full-stack development, progressive web apps, api development. We work with Finance & Fintech, Media & Entertainment, HealthTech companies in London, United Kingdom via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Design in London, United KingdomZTABS is a remote-first web design agency serving London businesses — including ui/ux design, responsive design, custom interfaces. We work with Finance & Fintech, Media & Entertainment, HealthTech companies in London, United Kingdom via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
AI Development in London, United KingdomZTABS is a remote-first AI development agency serving London businesses — including llm integration & fine-tuning, ai agents & automation, rag & knowledge systems. We work with Finance & Fintech, Media & Entertainment, HealthTech companies in London, United Kingdom via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Legacy App ModernizationLearn more about our legacy app modernization services nationwide.
Partner with ZTABS for expert legacy app modernization in London. Get a free consultation today.
