When one platform runs everything: eleven years of Monzo's architecture

A single-company dig, reconstructed from Monzo's own incident reports and engineering posts, its conference talks, and the archive banners and commit dates in its public repositories. It gives an architect the decade's forcing functions in order, a decision table with the condition that flips each choice, four incidents with transferable design rules, the cost ratio and scope of a minimum viable standby, and a six-rung ladder for building the same pattern at a scale they can test.

What you get out of it

• Both of Monzo's platform-wide outages came through the change path, not the request path: a planned etcd expansion in 2017 and a planned Cassandra cluster join in 2019.
• The 2017 outage was widened by its own remediation: restarting several hundred mesh instances at once exposed a version incompatibility a running instance never hit.
• If the risk you hedge is your own code, the standby must share none of it, which is what bounds it to 18 services, one-way replication, advice messages and about 1% of the primary platform's operating cost.
• Uniformity is the asset that lets one central team migrate 2,800 services, and it is the same property that makes every shared-infrastructure change a bank-wide event.
• In-house components that wrap a standard survive (typhon, 2015, still modernised in 2026) while those that substitute for one get retired, and the retirement shows up as a repository archive banner before it shows up in any blog post.

Scope

Why this, now. Monzo's standby bank launched in March 2025, the same month as the UK operational-resilience deadline, and was activated publicly again in August 2026 with some customers still unable to transact, so the pattern is now both widely copied and freshly questioned.

What it does not cover. The mobile applications, credit and fraud models, ledger internals and Monzo's cost base beyond published ratios; also absent from the public record, and marked open rather than inferred, are how either platform's Kubernetes control plane is provisioned after 2022 and any datastore detail after 2021.