Financial sector institution — Anti-Money Laundering Platform with Column-Level Encryption and OWASP

The challenge

A financial institution in Guatemala needed to manage customer due diligence (KYC), alerts, cases, and regulatory reports to the IVE, with bank-grade confidentiality and traceability requirements.

The solution

It was built with Express 5, React 19, Vite 7, and Drizzle on PostgreSQL, in a monorepo documented with 11 architecture decisions. Sensitive data is encrypted per column with AES-256-GCM and a blind index, auditing is immutable through triggers, and access requires TOTP with lockout after failed attempts. The platform screens customers against the OFAC and UN 1267 lists and signs reports to the IVE with HMAC. With 642 tests, 81.7% coverage, and the OWASP Top 10 checklist, all 4 project milestones were completed.

Technologies used

• React
• Express
• PostgreSQL
• Drizzle ORM
• OWASP
• AES-256-GCM

Results

• 642 Automated tests
• 81,7 % Code coverage
• 4 Milestones completed — Out of 4