CASE STUDY
DFCC Bank’s Resilient and Centralized API Transformation with WSO2 and IFINITY as the Implementation Partner
Product Area
API Management
Region
Asia Pacific
Industry
Financial Services
Highlights
Centralized governance without disruption:
Unified API lifecycle management across legacy and modern systems without altering core banking backends.
Consistent, financial-grade security
Standardized authentication, access control, and threat protection across all digital channels.
3-month go-live:
Delivered the project in three months with implementation partner IFINITY Global.
Overview
DFCC Bank is a premier financial institution committed to driving economic transformation and contributing to a more prosperous and sustainable Sri Lanka. Established in 1955 and listed on the Colombo Stock Exchange since 1956, DFCC Bank has built a strong legacy of supporting the country’s economic progress and development. Regulated by the Central Bank of Sri Lanka and rated A (lka) by Fitch Ratings, the Bank offers a comprehensive portfolio of retail, corporate, and SME banking services, complemented by treasury, investment, and trade finance solutions.
By blending tailored credit facilities and structured finance with an ambitious digital transformation roadmap, DFCC Bank uses its IT infrastructure to foster sustainable growth and turn business ambition into digital capacity.
Anchored by this foundation, DFCC Bank has built true corporate API banking in the Sri Lankan market. By moving away from rigid private connections, the bank has built a secure foundation for B2B and fintech collaborations. With this API infrastructure in place, built on the WSO2 API Platform, DFCC Bank can launch new digital products without re-engineering its backend systems each time.
Our API transformation journey with IFINITY and WSO2 has provided DFCC Bank with a secure, scalable, and resilient API management platform that supports our digital banking strategy. IFINITY demonstrated strong technical expertise, professionalism, and commitment throughout the implementation, successfully delivering the project within an accelerated three-month timeline. Leveraging the robust capabilities of the WSO2 API Platform, we have established centralized API governance, enhanced security, and a future-ready foundation that enables us to innovate faster while seamlessly integrating with our existing core banking systems."
Vindya Solangaarachchi
Senior Vice President/ Chief Information Officer IT
DFCC Bank
Challenge
As part of its digital transformation roadmap, DFCC Bank needed to expose core banking services to a growing set of customer channels, internal applications, and third-party integrations. Without a centralized API governance layer, this created several problems:
- Heterogeneous environments and disruption risk: Managing APIs across legacy and modern systems was complex. The bank needed a way to unify operations without disrupting its core banking systems.
- Legacy B2B integration friction: Like most banks in Sri Lanka, DFCC relied on rigid private connections that limited corporate transactions to batch processing and manual file uploads. Replacing this was necessary to give corporate clients real-time transaction visibility and direct syncing with their ERP and accounting systems.
- Security and visibility gaps: Security policies and traffic controls were applied inconsistently across core banking backends and external channels, creating uneven access management for payments and trade transactions. IT teams also had limited visibility into transaction throughput, API performance, and system health.
- Lifecycle and operational friction: Managing API versioning, deprecation, and traffic policies was difficult, and the lack of self-service developer tools slowed the launch of new digital banking products.
- Compliance pressure: As digital banking services expanded, meeting security standards, approval workflows, and audit standards became harder to manage.
Solution
DFCC Bank implemented the WSO2 API Platform as its core enterprise API management layer. The platform now sits between customer channels, partners, and internal applications, and integrates directly with the bank's core banking systems.
- API Gateway acts as a secure buffer protecting vital core banking backend systems. It governs all incoming traffic, enforces runtime policies, and routes transactional data without exposing sensitive internal networks.
- Developer Portal and Publisher give internal developers and third-party fintech partners a self-service workspace for API design, versioning, and management, reducing the bank's reliance on manual IT workflows. Built-in analytics provide operational tracking and visibility across the ecosystem.
- API Control Plane provides centralized governance, handling real-time traffic throttling, rate limiting, and threat protection to shield backend systems from traffic surges and unauthorized access.
Results
- Established a scalable API foundation: DFCC Bank now has an API banking platform that serves as the foundation for digital banking services, customer integrations, and future API initiatives.
- Centralized governance and monitoring: Streamlined API lifecycle control, traffic management, and security oversight across the enterprise ecosystem.
- Real-time, secure connectivity: Customers and partners now have real-time access to banking services, while the bank maintains its existing security controls, approval workflows, and audit requirements.
- Unified eco-system in digital banking: Bridged the gap between modern customer-facing channels and core backend banking systems through a secure, standardized API layer.
Partner
See what WSO2 can do for you
Browse the platform on your own, or bring your specific problem and current stack to an expert who can map the path forward.
Platform Overview Talk to an Expert