Legacy App Modernization in Riyadh for Government, Banking and Healthcare

ZTABS modernizes legacy applications for Riyadh enterprises in government, banking, healthcare and Vision 2030 transformation. Riyadh government entities operate legacy licensing and permit systems on aging platforms. Banking institutions run core systems requiring modernization for digital transformation. Healthcare providers operate clinical and administrative systems needing upgrades. ZTABS is remote-first by design from our Houston, Texas office.

Riyadh's legacy modernization demand spans government licensing system migration for digital government services, banking core platform modernization for open banking and digital payments, and healthcare system upgrades for Nphies integration and patient digital experience.

Legacy app modernization in Riyadh at a glance

Need	What we build	Key requirement
Government	Licensing system migration	Digital services, Nafath, SPL
Banking	Core platform modernization	SAMA, ZATCA, digital payments
Healthcare	System upgrades	Nphies, PDPL health controls
Enterprise	Legacy system migration	PDPL, data residency
Telecommunications	Platform modernization	CST compliance

Government licensing system modernization

Riyadh government entities operate legacy licensing and permit systems managing business registration, professional licensing, activity permits and regulatory compliance through decades-old technology.

Business licensing. Commercial registration, activity licensing and municipal permits processed through legacy systems with multi-step approval workflows. Legacy interfaces replaced with modern digital government services accessible through Nafath authentication.

Professional licensing. Professional qualification verification, licence issuance, renewal and compliance monitoring through legacy systems. Modernization enabling digital submission, automated verification and mobile access.

Regulatory compliance systems. Industry-specific compliance monitoring, reporting and enforcement through legacy batch processing. Modernization enabling real-time compliance monitoring and automated reporting.

SPL National Short Address. Saudi Post (SPL) provides the National Short Address system for address standardisation in government systems.

Banking core modernization

Riyadh banks operate core systems on mainframe and mid-range platforms processing retail banking, corporate banking, trade finance and Islamic banking products.

Core banking migration. Account management, transaction processing, general ledger and customer information modernized. SAMA regulatory requirements addressed at each migration phase. Islamic banking product logic including murabaha, ijara, musharaka and wakala preserved.

ZATCA integration. ZATCA notified Phase 2 standard clearance before sending to buyer. Simplified invoices reported within 24 hours. Legacy invoice processing modernized for electronic invoicing with ZATCA API integration. VAT group representative and group VAT arrangements configured.

Digital payments. SADAD, mada and SARIE integration. Legacy batch-oriented payment processing modernized for real-time capabilities.

GOSI integration. Subscriber history and cohort management. Legacy payroll and HR systems modernized for current GOSI reporting requirements.

Healthcare system modernization

Riyadh healthcare providers operate clinical and administrative systems requiring modernization for Nphies integration and digital health services.

Nphies integration. Nphies actual approved provider, resource, data and action rights. Healthcare system modernization for electronic health insurance claims submission and processing through Nphies.

Clinical system upgrades. Legacy clinical systems modernized for interoperability, electronic health records and patient digital experience.

PDPL health controls. Saudi PDPL Article 23 provides health-specific additional minimum access controls, not a general medical-record retention period or exemption from PDPL. Actual health record retention depends on applicable health authority requirements. Healthcare data handled with appropriate access controls during and after modernization.

Saudi regulation

Saudi PDPL. Article 23 provides health-specific additional minimum access controls, not exemption or general medical-record retention period. Article 6 provides legal bases beyond consent: data subject interests where contact is impossible or difficult, another law or implementation of a previous agreement to which the data subject is party, controller is a public entity and processing is required for security or judicial requirements, and legitimate interests subject to conditions excluding public entities and sensitive data. Explicit consent required for sensitive personal data, credit information and solely automated decision-making under Regulation 11(2). Consent in other cases may be written, verbal or electronic in appropriate form. Withdrawal under Regulation 12 does not prevent processing that relies on another legal basis.

Cross-border transfer. Risk assessment under Transfer Regulation Article 8 applies to transfers relying on Articles 5 or 6, or continuous or large-scale transfer of sensitive data abroad. Other Article 5 and Article 6 transfer cases also trigger assessment. Not all cross-border data movement categorically requires the same assessment. Cloud hosting selection considers actual data residency requirements.

SAMA. Actual licensed bank and financial scope. Not all technology companies automatically need SAMA licensing. Banking system modernization meets applicable SAMA regulatory technology requirements.

CST. Current regulator name. Not obsolete CITC. Telecommunications system modernization references current regulatory body and requirements.

ZATCA Phase 2. Standard clearance before buyer. Simplified report within 24 hours. VAT group representative and group VAT. Electronic invoicing integration with ZATCA API.

Nafath. National single sign-on for government services. Actual approved provider and integration specifications. Not all services automatically use Nafath.

Absher. Ministry of Interior services platform. Actual available services and integration rights verified.

Nphies. Health insurance exchange. Actual approved provider, resource, data and action rights. Not all healthcare system integrations automatically available.

Strangler fig for government systems

Seam selection. Government seams: business licensing, professional licensing, permits, compliance monitoring, payments, reporting. Each function extracted independently.

Single authoritative write. One system authoritative for each licence and period during coexistence. Government dual-write dangerous for regulatory status tracking. CDC with versioning and conflict detection.

Reconciliation. Idempotency keys enforced by receiving side. Finite retries with DLQ. Unknown outcomes require reconciliation before replay, especially for licence status changes, ZATCA submissions and GOSI reporting.

Data migration methodology

Government data. Licence records, permit histories, compliance records, payment transactions and applicant data migrated with regulatory verification. Arabic and English bilingual content preserved. Document attachments migrated with metadata.

Banking data. Account records, transaction history, Islamic banking product records and regulatory data migrated with reconciliation against agreed validation controls. SAMA regulatory reporting data maintained.

Healthcare data. Patient records, clinical data, insurance claims and provider data migrated with PDPL Article 23 access controls. Nphies integration data verified.

Data type mapping. Types, nulls, time zones, currency, rounding, identifiers, encoding, history and crosswalks reconciled. Government-specific: licence types with regulatory classification, Hijri and Gregorian dates, National ID numbers, SPL short addresses. Banking-specific: Islamic banking product types, settlement dates, ZATCA invoice identifiers. Healthcare-specific: Nphies provider and resource identifiers, health insurance policy numbers.

Cutover rehearsal. Observable acceptance with measurable RTO, RPO and latency targets. Government cutover timed for licensing cycle boundaries. Banking cutover timed for settlement cycles.

Inventory and discovery

Riyadh enterprise modernization begins with inventory of applications, users, scheduled jobs, database procedures, reports, file and API dependencies, vendor contracts, supported versus end-of-life versions. Discovery documents known dependencies; undiscovered dependencies may surface during parallel operation.

Business rules discovered with users through representative transaction analysis. Government rules validated against current regulatory requirements. Banking rules validated against SAMA requirements. Healthcare rules validated against PDPL and Nphies requirements.

Integration and dependency management

Government integrations. Inter-entity connections, Nafath identity, Absher services, ZATCA invoicing, GOSI reporting, SPL addressing and payment platforms.

Banking integrations. SAMA regulatory reporting, SADAD, mada, SARIE, SWIFT and correspondent bank connections.

Healthcare integrations. Nphies insurance exchange, provider systems and Ministry of Health reporting.

Modernization approach selection

Riyadh enterprises need clear criteria for choosing between approaches.

Targeted remediation. Adding specific capabilities to otherwise functional systems. Example: adding API layer for mobile citizen access while keeping legacy for back-office processing.

Re-platforming. Moving to modern infrastructure while preserving logic. Example: migrating legacy licensing to cloud while preserving approval workflow rules.

Re-architecture. Decomposing monolith into services. Example: extracting licensing, permits, payments and reporting as independent services.

Full rebuild. Ground-up development as part of Vision 2030 digital transformation.

Regression and testing

Representative business-critical paths: licensing lifecycle, ZATCA invoice submission, Nphies claims processing, banking transaction lifecycle. Meaningful integration, performance and manual UAT with domain expert approval.

Cost and timeline

Legacy system modernization follows the published cost guide.

Tier	Range	Timeline	Example
UI Modernization	$40K to $100K	8 to 16 weeks	New frontend, API wrapper, improved UX
Re-Platforming	$100K to $250K	16 to 32 weeks	Modern stack, containerization, cloud, data migration
Re-Architecture	$250K to $400K	8 to 14 months	Decompose monolith, event-driven, modern data layer
Full Rebuild	$400K to $500K+	12 to 18+ months	Ground-up rebuild, agreed availability target, rehearsed staged cutover

Vendor comparison

Ranges are 2026 US-buyer guide-based estimates for re-platforming a 10 to 15 year old business-critical system using a strangler fig approach, modern stack, API wrappers, phased data migration and regression harness.

Vendor type	Typical cost	Timeline
Freelance or dev collective	$40K to $130K	5 to 12 months
Offshore systems integrator	$60K to $200K	8 to 14 months
ZTABS	$100K to $280K	6 to 12 months
Big 4 consultancy	$300K to $1M+	10 to 18 months
SaaS replacement vendor	$50K to $200K implementation	4 to 9 months

Ranges are 2026 US-buyer benchmarks from the published cost guide. Parallel-running infrastructure, senior knowledge transfer and where applicable compliance revalidation can add a combined scope-dependent $100K to $500K+ planning allowance. The guide's examples are SOX, HIPAA and FDA; actual applicable regime depends on the engagement.

Proposal evaluation criteria

Evaluate any vendor proposal against these six criteria regardless of price tier.

Criterion	What to verify
Strategy, deliverables and acceptance	Defined modernization phases with measurable acceptance criteria at each stage
Data source-of-truth and reconciliation	Which system is authoritative per object and period, agreed reconciliation tolerances and exception register
Rehearsal, cutover and rollback	Rehearsed cutover with RTO and RPO targets, documented rollback feasibility after schema and data changes
Security, privacy, compliance and approval scope	Applicable regulations identified with actual approval authority and scope
Full recurring costs	Licensing, parallel-run infrastructure, support, monitoring and decommission costs beyond initial build
Human roles and responsibilities	Provider and customer trainer-validator-support split, agreed working languages, translated materials review and on-site responsibilities where needed

How delivery works

ZTABS is remote-first by design from our Houston, Texas office. Overlap with Riyadh business hours for coordination and review.

Logs and retention

Logs minimise and redact secrets and regulated payloads with actual retention and legal holds. Government records retained per Saudi regulatory requirements. Banking records retained per SAMA requirements. Healthcare records retained per applicable health authority requirements and PDPL Article 23 controls. ZATCA invoice records retained per tax authority requirements.

Cutover rehearsal detail

Observable acceptance with measurable RTO, RPO and latency targets. Government cutover timed for licensing cycle boundaries. Banking cutover timed for settlement cycles and ZATCA reporting periods. Healthcare cutover timed for Nphies integration windows.

Rollback feasibility assessed after schema, data and contract changes. Licence status changes, ZATCA invoice submissions, Nphies claims and banking transactions may not be automatically reversible. Compensations can require legal, regulatory or accounting review.

Data type mapping for Riyadh industries

Riyadh industry data has unique types requiring careful migration planning. Government: licence types with commercial registration classification, Hijri and Gregorian calendar dates with conversion rules, National ID and Iqama numbers, SPL National Short Address codes, fee schedules with VAT at 15 percent on applicable goods and services. Banking: IBAN formats with Saudi bank codes, Islamic banking product types with Sharia-compliant transaction structures, ZATCA invoice identifiers with standard versus simplified classification, SADAD payment reference numbers. Healthcare: Nphies provider and resource identifiers, health insurance policy numbers, diagnosis codes, procedure codes, patient identifiers with PDPL controls.

Assessment methodology

Application archaeology for Riyadh systems covers legacy code analysis for business rule extraction, database analysis for data structure documentation, integration mapping for government platform connections including Nafath, ZATCA, GOSI and Nphies, and bilingual content analysis for Arabic and English language requirements. Banking assessment covers core banking programme analysis, Islamic banking product rule extraction, and SAMA regulatory reporting analysis. Healthcare assessment covers clinical system analysis, Nphies integration mapping and PDPL health control requirements.

Risks and mitigations

Business rule gaps. Application archaeology combined with parallel operation catches undiscovered rules within agreed discovery coverage. Government domain experts validate extracted licensing and permit rules. Banking domain experts validate Islamic banking product rules. Undiscovered rules remain a managed residual risk.

Bilingual content. Arabic and English content migrated with language-specific validation. Right-to-left rendering and Arabic typography preserved in modern interfaces.

ZATCA compliance. Electronic invoicing validated against ZATCA Phase 2 requirements for both standard and simplified invoices.

Data residency. Saudi data residency for covered data, contracts and applicable entity obligations scoped at engagement start. Full-stack residency including storage, backups, logs, support access and subprocessor jurisdictions verified per provider before commitment. Cross-border transfer risk assessment per applicable PDPL Transfer Regulation requirements.

When ZTABS is not the right fit

• The system still works and nobody is asking for changes. Wait for a real forcing function.
• ERP implementation from licensed vendor. Vendor selection and implementation scope.
• On-site embedded team. ZTABS is remote-first by design. On-site staffing, training and support retainers for this engagement are separately agreed.
• SAMA or ZATCA regulatory advisory. This engagement builds platforms, not regulatory advice. Regulatory advisory is separately engaged.

White-label AI products

ZTABS builds custom white-label AI products for clients to brand and resell. Riyadh technology companies can commission white-label AI platforms for distribution under their own brand.

Handover

Modernization handover includes runbooks, data lineage, licensing, support contacts and accountable owners. Government handover includes regulatory compliance documentation, bilingual content documentation and integration specifications for Nafath, ZATCA, GOSI and Nphies. Banking handover includes SAMA reporting specifications and Islamic banking product documentation.