Non-Functional Requirements (NFR): FinTech Modernization Platform Measurable quality attributes. Each NFR is testable and tied to an SLO or control.
ID
Requirement
Target
NFR-P1
Ledger post latency
p50 < 40 ms, p99 < 250 ms
NFR-P2
Balance query latency
p99 < 50 ms
NFR-P3
Sustained throughput
50,000 TPS peak
ID
Requirement
Target
NFR-S1
Horizontal scale of stateless services
Linear to 20+ instances
NFR-S2
Event backbone partitioning
>= 20 partitions on ledger.events.v1
NFR-S3
Storage growth handling
Tiered retention; cold offload to lakehouse
3. Availability and reliability
ID
Requirement
Target
NFR-A1
Ledger write API availability
99.99% (~52 min/yr error budget)
NFR-A2
Durability of acknowledged postings
Zero acknowledged-then-lost
NFR-A3
RPO / RTO
RPO ~0 for the event log; RTO < 15 min via rebuild
ID
Requirement
Target
NFR-C1
Per-account ordering
Strict (single partition per aggregate)
NFR-C2
Cross-account read model
Eventual (async mode) / strong (sync mode)
NFR-C3
Idempotency
Exactly-once effect per payment identifier
ID
Requirement
NFR-SEC1
TLS in transit; encryption at rest for event store and projections.
NFR-SEC2
AuthN/Z on all APIs; least-privilege service identities.
NFR-SEC3
No PII in event keys; sensitive fields tokenized.
NFR-SEC4
Full audit trail (the event log is itself the audit record).
6. Compliance and auditability
ID
Requirement
NFR-CMP1
Every money movement is reconstructable point-in-time from the event log.
NFR-CMP2
Compensations are recorded as new events; history is never mutated.
NFR-CMP3
Reconciliation evidence retained for the regulatory retention period.
ID
Requirement
NFR-O1
Metrics (Micrometer/Prometheus) on every service; golden signals dashboards.
NFR-O2
Correlation id propagated from command through saga and emitted events.
NFR-O3
Canary SLO analysis queries error rate and p99 latency directly.
8. Operability and portability
ID
Requirement
NFR-OP1
One-command local bring-up (docker compose up).
NFR-OP2
Progressive delivery with automated rollback on SLO breach.
NFR-OP3
Cloud-agnostic: container + Kafka + relational DB; no proprietary lock-in.