ZTABS delivers legacy app modernization in Sydney — mainframe migration, COBOL replacement, monolith decomposition, and cloud-native transformation for Australian banking, insurance, superannuation, and government organisations operating systems that are decades old.
Legacy app modernization in Sydney addresses a challenge that is particularly acute in Australia — the country's largest institutions running critical operations on systems built in the 1980s and 1990s, with modernization constrained by regulatory oversight, data sovereignty requirements, and the sheer scale of transactions these systems process daily. Sydney's legacy modernization landscape is shaped by: the depth of Australia's legacy estate (Australian financial institutions operating some of the oldest banking systems in the developed world. The Big Four banks (CBA, Westpac, NAB, ANZ) each maintaining mainframe estates that process millions of transactions daily — CBA's core banking transformation (CommSee to SAP, then to its modern core) being a decade-long A$1B+ programme that demonstrated both the necessity and the complexity of legacy modernization. Westpac's CSC Hogan core banking system, NAB's legacy platforms, and ANZ's systems — each representing decades of accumulated business logic, regulatory compliance, and customer data. Beyond banking: Australian general insurers running policy administration systems from the 1990s, superannuation funds operating member administration on platforms designed for a fraction of their current membership, and NSW Government agencies running systems on end-of-life technology with dwindling vendor support), APRA regulatory constraints (legacy modernization in Australian financial services operating under APRA's supervisory gaze. CPS 231 (Outsourcing): any modernization involving third-party platforms or cloud services requiring APRA notification and potentially consultation — APRA wanting assurance that the institution maintains control and operational resilience during and after migration. CPS 232 (Business Continuity Management): modernization programmes needing to demonstrate that migration doesn't compromise business continuity — meaning parallel running, rollback capability, and continuous service during transition. CPS 234 (Information Security): modernized systems needing to meet or exceed the security posture of legacy systems — no regression in security controls during migration. APRA scrutiny of technology transformations has increased since Westpac's AUSTRAC penalties (A$1.3B) and various technology incidents — regulators expecting detailed migration plans, risk assessments, and evidence of testing before approving significant system changes), data sovereignty and residency (Australian organisations — particularly banks, insurers, and government — requiring that customer data remains in Australia. Legacy systems typically running in on-premises Australian data centres — modernization to cloud requiring Australian cloud regions (AWS ap-southeast-2, GCP australia-southeast1, Azure Australia East). This constraint limiting architecture choices and vendor options — not every modern platform being available or certified for Australian data residency. Cross-border data transfer: the Privacy Act 1988 requiring that personal information transferred overseas receives equivalent protection — adding compliance requirements to any modernization that involves international cloud services or offshore development teams), and workforce challenges (Australia's COBOL and mainframe skills pool shrinking — the developers who built these systems in the 1980s and 1990s retiring. Universities no longer teaching COBOL or mainframe operations. This skills gap creating urgency for modernization — not just for technical reasons but because the ability to maintain and operate legacy systems is diminishing. The challenge: modernization requiring both legacy skills (to understand and extract existing business logic) and modern skills (to architect and build replacement systems) — a combination that is increasingly rare in the Australian job market)).
Sydney's legacy modernization demand spans financial services, government, healthcare, utilities, and telecommunications — each with legacy estates shaped by decades of Australian market evolution. Banking legacy modernization: the largest and most complex opportunity. Core banking: Australia's major banks processing hundreds of millions of transactions annually on core systems that — in some cases — date back to the 1980s. Core banking modernization involves: account management (savings, transaction, mortgage, business accounts — each with accumulated business rules and regulatory requirements built over decades), payments processing (NPP real-time payments, BPAY, direct entry, international transfers — each payment rail integrated into legacy cores), lending origination and management (mortgage systems, personal lending, business lending — with Australian-specific requirements including responsible lending obligations under the National Consumer Credit Protection Act), and regulatory calculations (capital adequacy, liquidity ratios, large exposure reporting — calculated from core banking data per APRA standards). Mainframe to cloud: several Australian banks in active mainframe-to-cloud migration programmes — moving from IBM z/OS or Unisys mainframes to cloud-hosted platforms. The migration: not just a technology change but a fundamental transformation of how banking technology operates — from batch processing cycles to real-time event-driven architectures. Insurance legacy modernization: policy administration systems from the 1990s. Australian general insurers (Suncorp, IAG, QBE) and life insurers (AIA, TAL, MLC) running policy administration systems that predate the internet. These systems: processing policy lifecycle (quote, bind, endorse, renew, cancel) for millions of policies, managing claims workflows (notification, assessment, payment) with business rules accumulated over decades, calculating premiums using actuarial models integrated with legacy policy systems, and producing regulatory returns for APRA prudential reporting. Modernization challenge: policy administration systems containing decades of product definitions, underwriting rules, and claims logic — much of it undocumented, embedded in COBOL copybooks or Assembler routines. Government legacy modernization: NSW and federal systems. NSW Government: agencies running systems on end-of-life platforms — AS/400, Oracle Forms, Lotus Notes, and custom-built systems from the 1990s and 2000s. Revenue NSW, Transport for NSW, and social services agencies each having legacy modernization requirements. Federal government: Services Australia (Centrelink, Medicare, Child Support) operating one of Australia's largest legacy technology estates — processing social services payments for millions of Australians on systems originally built decades ago. The modernization: constrained by: scale (millions of citizens depending on continuous service), political sensitivity (system failures directly impacting vulnerable Australians), and procurement complexity (government procurement processes adding months to modernization timelines). Superannuation legacy modernization: member administration platforms. Australia's superannuation sector — with A$3.5T+ in assets — running member administration on platforms designed when the industry was smaller and less complex. Fund mergers (Australian Retirement Trust formed from QSuper + Sunsuper, Aware Super from First State + VicSuper + WA Super) creating urgent modernization needs — merged funds needing to consolidate disparate member administration platforms. The challenge: member data migration involving millions of accounts with complex history (contribution records, insurance policies, beneficiary details, investment choices) — where data errors can directly impact members' retirement savings. Telecommunications: Telstra and Optus running billing and customer management systems that have been extended and modified through multiple technology generations — from fixed-line telephony through mobile to NBN.
Our Sydney legacy modernization methodology delivers zero-downtime migration with regulatory compliance and data integrity preservation. Legacy assessment and planning: understanding before transforming. Application portfolio analysis: cataloguing the legacy estate — technology stack, business capability, transaction volumes, integration points, data stores, and dependency mapping. Each application classified by: strategic value (does it support a differentiating business capability?), technical risk (end-of-life platform, skills availability, security vulnerabilities), business risk (regulatory compliance, customer impact if the system fails), and modernization approach (retain, retire, rehost, replatform, refactor, rebuild, or replace). Business logic extraction: systematically extracting business rules from legacy code — COBOL paragraphs, JCL job streams, copybook data structures, and operational procedures. This extraction producing a business rules catalogue that serves as the specification for the modernized system. Data archaeology: mapping legacy data structures — often decades of schema evolution with: deprecated fields still populated, undocumented code values, implicit relationships not enforced by the database, and data quality issues accumulated over years. The data mapping producing a transformation specification for data migration. Modernization execution: multiple strategies based on assessment. Strangler fig pattern: the primary modernization strategy for large, complex legacy systems. Rather than replacing the entire system at once (big bang — high risk, historically poor success rate in Australian financial services), the strangler fig progressively replaces legacy capability with modern services. Each business capability migrated independently: modern service built → traffic gradually routed from legacy to modern → legacy capability retired when modern is proven. The pattern: enabling continuous production operation during modernization, with rollback to legacy at any point if issues are discovered. API facade: placing an API layer in front of legacy systems — enabling modern applications to consume legacy functionality through clean, documented APIs. The facade: decoupling consumers from legacy internals, enabling parallel development (modern applications built against the API contract while legacy is progressively replaced behind it), and providing observability (API metrics revealing actual usage patterns — often discovering that 80% of legacy code supports 20% of actual usage). Event-driven migration: implementing event sourcing alongside legacy systems — capturing business events (account opened, payment made, claim lodged) as they occur in the legacy system, projecting them into modern data stores. Over time: the modern event store becoming the source of truth, with the legacy system eventually becoming a consumer of events rather than the system of record. Cloud-native architecture: building modernized systems on cloud-native patterns. Container orchestration: Kubernetes (EKS on AWS, GKE on GCP) running in Australian regions — microservices architecture replacing monolithic legacy applications. Managed services: using cloud-native databases (Aurora, Cloud SQL), messaging (SQS/SNS, Pub/Sub), and caching (ElastiCache, Memorystore) — reducing operational burden compared to self-managed infrastructure. Infrastructure as code: all infrastructure defined in Terraform — enabling consistent, repeatable deployment across environments (development, staging, production, and disaster recovery). Data migration: the highest-risk element. Zero-downtime data migration: implementing change data capture (CDC) from legacy databases — Debezium or AWS DMS streaming changes from legacy to modern data stores in real-time. Dual-write verification: during transition, both legacy and modern systems processing transactions — automated reconciliation comparing results and flagging discrepancies. Data quality remediation: fixing data quality issues during migration — cleaning addresses, standardising codes, resolving duplicates, and validating referential integrity. Migration verification: automated testing comparing legacy output with modern output for millions of test cases — regression testing at scale to ensure the modernized system produces identical results.
Financial Services / Insurance
An Australian general insurer (APRA-regulated, A$3.6B gross written premium, 2.8M policies across motor, home, strata, and commercial lines, 4,200 employees) operated its core policy administration on a COBOL-based system running on IBM AS/400 hardware — the system originally implemented in 1994 and continuously extended for 30 years. The AS/400 system: processing the complete policy lifecycle (quote, bind, endorse, renew, cancel, lapse) for 2.8M active policies, managing 380,000+ claims annually (notification through assessment through payment), calculating premiums using actuarial rating factors embedded in COBOL code (not externally configurable — any pricing change requiring COBOL code modification, testing, and deployment), producing APRA prudential returns (quarterly statistical returns, capital adequacy calculations, reinsurance reporting), and generating 4.2M customer communications annually (policy schedules, renewal notices, claims correspondence). Operational risks: AS/400 hardware approaching end of vendor support — IBM providing extended support but at increasing cost (A$2.4M/year maintenance — up from A$800K five years earlier). COBOL developer pool: 6 remaining developers with AS/400/COBOL expertise — average age 58, two planning retirement within 18 months. The insurer unable to recruit COBOL replacements despite offering A$220K+ salaries. Business constraints: the AS/400 system having been extended so many times that modifications were increasingly difficult and risky. A simple product change (adding a new rating factor to motor insurance pricing): 8-12 weeks development and testing, compared to days on modern platforms. Integration limitations: the AS/400 communicating through file-based batch interfaces — no real-time APIs. This preventing: real-time quoting on the website (quotes generated overnight in batch, displayed the next day — customers abandoning to competitors offering instant quotes), straight-through processing for simple claims (all claims requiring manual assessment because the system couldn't process automated rules in real-time), and partner integration (broker portals, aggregator connections, and reinsurer data exchanges all constrained by batch processing windows). The overnight batch window: 6 hours — and growing. New products or regulatory requirements adding batch jobs, with the 6-hour window increasingly tight. A batch overrun had occurred twice in the past year — delaying morning operations and requiring manual intervention. APRA concern: APRA had specifically raised the technology risk in their most recent supervisory review — noting the concentration risk of a single legacy platform, the skills dependency on a small team, and the lack of a documented modernization roadmap. APRA requested a written modernization plan within 6 months.
We designed and executed a strangler fig modernization programme over 18 months, with the first production capability delivered at month 6. Assessment and architecture (months 1-3): understanding 30 years of business logic. COBOL analysis: systematic analysis of 2.1M lines of COBOL code — using automated tools (SonarQube COBOL analysis, custom AST parsing) to identify: active code paths (only 62% of the COBOL code was actually executed in production — 38% being dead code from deprecated products, regulatory changes, and abandoned features), business rules (4,800 distinct business rules extracted — product eligibility, pricing factors, underwriting rules, claims assessment rules, and regulatory calculations), data structures (680 COBOL copybooks defining data formats — many with overlapping definitions from decades of modifications), and integration points (47 batch interfaces with external systems — brokers, reinsurers, banks, and government agencies). Target architecture: event-driven microservices on AWS (ap-southeast-2 — Australian data residency) — each business capability implemented as an independent service: quoting service (real-time premium calculation), policy service (policy lifecycle management), claims service (claims processing and assessment), billing service (premium collection and payment processing), pricing engine (externally configurable rating factors — actuaries directly managing pricing without developer involvement), document service (customer communication generation), and reporting service (APRA regulatory returns and management reporting). API facade (months 2-5): enabling parallel operation. API gateway: Kong API gateway deployed in front of the AS/400 — exposing legacy capability through REST APIs. For each business capability, an API contract defined before modernization began — modern consumers coded against the API contract, with the initial implementation routing to legacy and the eventual implementation routing to the modern service. This approach: enabling the website team to start building real-time quoting immediately (against the API facade routing to legacy), with the modern quoting service replacing the legacy implementation transparently when ready. Quoting service modernization (months 4-8): the first strangler. Modern quoting: rebuilt in TypeScript/Node.js on AWS Lambda — implementing the 280 extracted pricing rules for motor insurance. Actuarial pricing factors: externalized into a configuration database — actuaries updating pricing through a web interface, changes taking effect within minutes (vs. 8-12 weeks of COBOL development). Real-time quotes: the quoting API returning a quote in <500ms — enabling the website to offer instant quotes for the first time. A/B comparison: for 4 weeks, every quote generated by both the legacy AS/400 batch process and the modern quoting service — automated comparison of 420,000 quote pairs. Match rate: 99.97% exact match. The 0.03% discrepancy: traced to floating-point rounding differences between COBOL decimal arithmetic and JavaScript — resolved by implementing COBOL-compatible decimal libraries. Go-live: modern quoting replacing legacy for motor insurance, then progressively extended to home, strata, and commercial over months 6-10. Policy service modernization (months 7-12): the core capability. Modern policy service: Java/Spring Boot microservices on EKS (Kubernetes) — implementing policy lifecycle management for all product lines. Data migration: 2.8M active policies migrated from AS/400 DB2 to PostgreSQL (Aurora) — using AWS DMS for initial load and change data capture for ongoing synchronization. Data quality: migration scripts cleaning 340,000 data quality issues identified during assessment — address standardization, code normalization, and duplicate resolution. Parallel running: both legacy and modern systems processing policy transactions for 8 weeks — automated reconciliation comparing every policy state change. Discrepancy rate: 0.012% — each discrepancy investigated and resolved before cutover. Claims service modernization (months 10-15): automated assessment. Modern claims: event-driven claims processing on AWS — claim notification triggering automated assessment rules. Straight-through processing: simple claims (motor windscreen, home contents under A$5,000) automatically assessed and approved — no human intervention required. Complex claims: routed to assessors with full context — claim details, policy coverage, customer history, and similar historical claims for reference. The automated assessment: processing 40% of claims without human intervention (previously 0% — every claim requiring manual assessment). APRA reporting modernization (months 12-16): regulatory compliance. Modern reporting: real-time data pipeline (Kafka → Snowflake) replacing batch extracts — regulatory data available continuously rather than through end-of-month batch processing. APRA returns: automated generation from the modern data platform — quarterly statistical returns, capital adequacy calculations, and reinsurance reporting. The reporting: reconciled against legacy AS/400 reports for two quarters before legacy reports were retired. AS/400 decommission (months 16-18): retiring the legacy. Progressive shutdown: AS/400 batch jobs decommissioned one by one as each capability was verified on the modern platform. Final AS/400 shutdown: month 18 — 30 years after implementation. Data archive: complete AS/400 data archived to S3 Glacier — meeting 7-year regulatory data retention requirements. APRA notification: formal notification to APRA at each major migration milestone — quoting, policy, claims, and decommission. APRA supervisory team reviewing migration evidence and providing clearance at each stage.
The modernization programme completed at month 18, with business benefits accruing from month 6 (first modern service in production). Real-time quoting: instant quotes replacing overnight batch — website quoting conversion rate from 3.2% to 8.7% (172% improvement). The improvement attributed entirely to real-time quotes: customers who previously abandoned (waiting overnight for a quote) now completing the journey instantly. Revenue impact: estimated A$24M annual premium increase from improved online conversion. Policy processing: policy lifecycle operations (endorsements, renewals, cancellations) from batch processing (overnight) to real-time — brokers able to service customers immediately rather than waiting for overnight processing. Broker satisfaction: NPS from 22 to 58. Claims automation: 40% of claims now straight-through processed (from 0%) — average simple claim settlement time from 12 business days to 2.4 hours. Customer satisfaction: claims NPS from 18 to 52. Complex claims: assessor productivity improved 35% — modern system providing assessors with full context, similar claim history, and automated reserve calculations. Pricing agility: product pricing changes from 8-12 weeks (COBOL development) to same-day (actuarial configuration change). This agility enabling: competitive pricing responses (matching competitor pricing moves within days, not months), seasonal pricing adjustments (adjusting cyclone-exposed property pricing before storm season), and micro-segmentation (more granular pricing factors — improving combined ratio by 1.2 percentage points through better risk selection). Technology risk reduction: AS/400 hardware and maintenance costs eliminated — A$2.4M/year saving. COBOL skills dependency eliminated — 6 COBOL developers retrained to modern technologies (4 chose to retrain, 2 retired with the insurer funding transition support). Platform supported by 22 modern developers (TypeScript, Java, Python) — recruitment pipeline healthy. APRA compliance: APRA supervisory finding (technology risk) closed — APRA acknowledging the modernization as a model implementation. Regulatory reporting time: from 15 business days (manual compilation) to 2 business days (automated generation with human review). Operational efficiency: overnight batch window eliminated — all processing real-time. Batch overrun incidents: from 2/year to 0. System availability: from 99.2% (including planned batch windows) to 99.95%. Financial summary: annual premium growth (real-time quoting conversion improvement): A$24M. Claims efficiency (straight-through processing + assessor productivity): A$8.2M/year. Pricing agility (combined ratio improvement): A$43.2M/year (1.2 percentage points on A$3.6B GWP). AS/400 cost elimination: A$2.4M/year. Operational efficiency (batch processing elimination, broker productivity): A$3.6M/year. Total annual impact: A$81.4M. Modernization programme cost: A$14.8M (18-month programme). First-year ROI: 450% (calculated from month 6 when first benefits accrued, annualized).
Modernize one module at a time — reducing risk, delivering value early, and keeping the business running throughout.
We extract and document the business rules embedded in legacy code so nothing gets lost in the new system.
Migrate from legacy databases (Access, FoxPro, SQL Server) to modern PostgreSQL or cloud-managed databases.
Build modern REST or GraphQL APIs that let the new system talk to legacy components during the transition period.
Create comprehensive test suites that verify the new system behaves identically to the old one for every critical workflow.
Deploy the modernized application on AWS, Azure, or Vercel with CI/CD pipelines, monitoring, and auto-scaling.
Sydney's legacy modernization market includes global system integrators (Accenture, Infosys, TCS, Wipro — offering large-scale legacy modernization with offshore delivery models, experienced with banking and insurance transformations but often with multi-year timelines and cost overruns), Australian consultancies (Deloitte, PwC — offering advisory-led modernization with Australian financial services expertise, but typically subcontracting implementation), platform vendors (Temenos for banking, Guidewire for insurance, SAP — offering platform replacement rather than custom modernization, which can be faster but constrains future flexibility), and niche modernization firms (COBOL-to-Java conversion specialists — offering automated code translation that preserves legacy structure in modern syntax without architectural improvement). ZTABS differentiates through strangler fig methodology (progressive modernization with continuous production operation — not big-bang replacement), APRA regulatory experience (understanding the supervisory requirements for financial services modernization), Australian data sovereignty architecture (cloud-native on Australian regions with appropriate security controls), and business logic extraction expertise (systematically extracting and documenting decades of embedded business rules).
Legacy app modernization in Sydney ranges significantly by scope. Legacy assessment and roadmap (application portfolio analysis, 4-6 weeks): A$100,000-250,000. API facade implementation (legacy wrapping, 6-10 weeks): A$150,000-400,000. Single application modernization (strangler fig, 12-20 weeks): A$400,000-1,200,000. Core system modernization programme (banking or insurance core, 12-24 months): A$2,000,000-15,000,000+. Data migration (legacy to modern database, 8-14 weeks): A$200,000-600,000. COBOL-to-modern rewrite (per application, 10-16 weeks): A$300,000-800,000.
Verified reviews from real client engagements — sourced from our public testimonial archive and Clutch profile.
My experience is throughout positive. Communication, service, the short response times and the flawless execution of a challenging topic was absolutely great. ZTABS is definitely my first choice again.
Christian Neff
Bank Software Advisory · Bank Software Advisory
Fintech
Fantastic Agency! I couldn't fault them even if I tried. They always go above and beyond to meet your expectations and always produces quality work. Thank you ZTABS.
Stephanie Kal
CEO · Beauty Finder Australia
Marketplace
It has been great working with ZTABS. They bounce off the ideas along the way. Amazing Experience.
Joel Rowe
CEO · Drill Quoter
Marketplace
We don't just contract. We ship and operate our own software. 23 products in production.
Common questions about legacy app modernization for Sydney businesses
Yes. We use the strangler fig pattern — progressively replacing legacy capabilities with modern services while the legacy system continues operating. Each capability migrates independently with parallel running and automated reconciliation. Rollback available at every stage.
ZTABS is a remote-first legacy app modernization agency serving Houston businesses — including incremental modernization, business logic preservation, data migration. We work with Energy & Oil/Gas, Healthcare & Biotech, Aerospace & Defense companies in Houston, TX via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Legacy App Modernization in New York, NYZTABS is a remote-first legacy app modernization agency serving New York businesses — including incremental modernization, business logic preservation, data migration. We work with Finance & Fintech, Media & Advertising, Fashion & Retail companies in New York, NY via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Legacy App Modernization in Los Angeles, CAZTABS is a remote-first legacy app modernization agency serving Los Angeles businesses — including incremental modernization, business logic preservation, data migration. We work with Entertainment & Media, E-commerce & DTC Brands, Gaming & AR/VR companies in Los Angeles, CA via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Development in Sydney, AustraliaZTABS is a remote-first web development agency serving Sydney businesses — including full-stack development, progressive web apps, api development. We work with FinTech, PropTech, HealthTech companies in Sydney, Australia via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Design in Sydney, AustraliaZTABS is a remote-first web design agency serving Sydney businesses — including ui/ux design, responsive design, custom interfaces. We work with FinTech, PropTech, HealthTech companies in Sydney, Australia via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
AI Development in Sydney, AustraliaZTABS is a remote-first AI development agency serving Sydney businesses — including llm integration & fine-tuning, ai agents & automation, rag & knowledge systems. We work with FinTech, PropTech, HealthTech companies in Sydney, Australia via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Legacy App ModernizationLearn more about our legacy app modernization services nationwide.
Partner with ZTABS for expert legacy app modernization in Sydney. Get a free consultation today.
