What does financial services regulation demand of architecture that a general-purpose system does not provide?

The demands that change the design

• Reconstructability. It must be possible to show what the system held and did at a point in the past, and why a decision was made. That means immutable event history and versioned reference data, not a current-state database with an audit log bolted on.
• Segregation of duties enforced technically. The person who initiates cannot be the person who approves, and the person who deploys cannot unilaterally alter production data. A control that depends on people following a procedure is not evidence of segregation.
• Operational resilience with tested recovery. Regulators increasingly require demonstrated recovery within a stated time for critical business services, which makes disaster recovery an exercised capability rather than a document.
• Traceability from a reported figure to its source records, so a regulatory submission can be defended line by line.
• Change control with evidence, showing what changed, who approved it, and what testing was performed.

What this implies architecturally

Event sourcing or equivalent immutable history for anything that must be reconstructed. Bitemporal reference data, so a transaction is explicable using the rates and rules as they were at the time rather than as they are now. Deterministic pipelines, because a reported figure that cannot be reproduced cannot be defended.

The tension with modern practice

Erasure obligations conflict with immutability. A regulated record retention period and a right to erasure apply to the same estate, and the resolution is per-record: retention obligations generally prevail for records with a legal basis to keep, while everything outside that scope is erasable.

Crypto-shredding is the mechanism that makes both possible — the record's structure remains for audit while its personal content becomes unrecoverable. Deciding this per data category, in advance, is far cheaper than discovering the conflict when the first request arrives.