Skip to content
Computese home
Banking08Data platform

Granular regulatory data on Cloudera and Iceberg

Regulators are moving from summary templates to transaction-level data. On a bank’s own Cloudera platform, we proved it can answer two questions most banks cannot: where a filed number came from, and what it looks like cut a new way. Each answer is one SQL query.

Industry
Banking
Engagement
Proof of concept
Platform
Cloudera Data Platform, Private Cloud Base
Table format
Apache Iceberg
Data
Synthetic only, no customer data
Access
The platform’s own consoles only

Where it started.

Supervisors increasingly want data once, at transaction level, instead of dozens of overlapping summary reports. That moves most of the work from the reporting tool to the data platform: storage, lineage and governance.

  • A filed figure could not be traced to the records behind it, so explaining an old number meant weeks of rebuilding.
  • Every question outside the template became a development request, and each request took a quarter.
  • Most obligations in the new approach sit in the data platform, not in the reporting tool.

The shape of the work.

Drawn new for this page. No screens or data from the client's systems.

Five source feeds (core banking, payments, treasury, customer and reference data) land in a raw layer that is only ever appended to. Data then moves through a conformed layer with quality flags, a gold layer holding the attribute model, and reporting marts reconciled to gold. The reporting engine sits outside the scope. Each filing is pinned to a snapshot so it can be reproduced. Lineage, masking by role and an audit trail cover every layer.

Fig. 1 The data foundation, layer by layer. Drawn new; synthetic data only.

How it ran.

  1. 01

    Check

    Confirmed on day one which services, storage, Ranger permissions, Atlas hooks and Kerberos authentication really worked, before building on any assumption.

  2. 02

    Land

    Five source feeds (core banking, payments, treasury, customer and reference data) landed append-only in Iceberg raw tables through NiFi and Kafka, as batch, change data capture and micro-batch streams, reference data first.

  3. 03

    Model

    A conformed layer with a quality flag on every row and corrections resolved to their latest version; counterparties kept as SCD Type 2 versions; amounts converted at each reporting date’s exchange rate, stored beside the record; and the attribute model supervisors ask for, with residency, both maturity bases and both immediate and ultimate risk.

  4. 04

    Govern

    Atlas classifies personal data and draws lineage from every filed field back to its source. Ranger masks by tag and role on the same query, filters rows and audits every read.

  5. 05

    Prove

    Reproduced a filed figure from its Iceberg snapshot with time travel, traced a restatement to the records that changed, answered a new question live, and rehearsed the fallback path. Every SQL step was checked offline on DuckDB against expected results first.

Two numbers, both right.

A filed figure reproduced from its snapshot, the current figure after a restatement, and the records that explain the difference.

Every change to an Iceberg table makes a snapshot, and the submission register pins the snapshot behind each filing. The same query run with time travel on the filed snapshot reproduces the filed figure exactly; run on the latest snapshot it gives today’s figure after a restatement. The difference traces to two records in the raw layer, the original and its correction, both kept. Exchange rates at the reporting date, counterparties kept as versions and reference codes as of the date keep the old figure from drifting.

Fig. 2 Reproducing a filing, simplified. Drawn new; synthetic data only.

The stack, by layer.

Every product and practice in this work, named so an engineer can check it.

01Platform
  • Cloudera Data Platform
  • Private Cloud Base
  • Cloudera Manager
  • Kerberos
  • TLS
02Ingestion
  • Cloudera DataFlow
  • Apache NiFi
  • NiFi Registry
  • Apache Kafka
  • Change data capture
  • Micro-batch streaming
03Lakehouse
  • Apache Iceberg
  • HDFS
  • Apache Ozone
  • Time travel
04Processing and query
  • Apache Impala
  • Apache Hive on Tez
  • Hue
  • Apache Spark
  • Cloudera Data Visualization
05Governance (SDX)
  • Apache Atlas
  • Apache Ranger
  • Apache Knox
  • Tag-based masking
  • Row filters
  • Business glossary
06Data modelling
  • Medallion layers
  • SCD Type 2
  • Point-in-time exchange rates
  • As-of reference joins
  • Submission register
07Testing
  • Python
  • DuckDB
  • Acceptance SQL suite
  • Deterministic synthetic data

Constraints we worked within.

Console access only
No shell and no direct database connection: every step went through Hue, Cloudera Manager, NiFi, Ranger and Atlas.
Kerberos and TLS everywhere
Every client, from NiFi flows to Kafka producers, authenticates with Kerberos over TLS. No shortcuts.
Planned engines unavailable
The streaming and Spark engines in the design were not available, so it went SQL-first on Hive and Impala, with one rule: ingestion writes only the raw layer, and SQL builds everything above it.
No official data dictionary yet
The attribute model follows public descriptions and is built to be swapped for the official one.

What changed.

  • Every source table loaded with exactly the expected row counts.
  • Quality rules flagged exactly the records they were designed to flag, on the first run.
  • Every reporting mart reconciles to the gold layer with zero difference.
  • A filed figure reproduced from its snapshot, and a restatement traced to the records that changed.
  • Point-in-time exchange rates and versioned counterparties, planned as roadmap items, delivered in the proof of concept.

What we learned.

  1. 01Sell the question, not the architecture. Layers and lineage are table stakes; answering the client’s two questions with one query is what convinces.
  2. 02Keeping raw records is the easy half. Reproducing an old figure also needs versioned reference data, exchange rates and master data.
  3. 03Iceberg history is easy to lose: dropping and recreating a table erases its snapshots, so write with insert-overwrite instead.
  4. 04An append-only raw layer needs de-duplication to the latest version above it, or the first correction is counted twice.
  5. 05Test the logic offline first. A laptop harness caught join, window and point-in-time bugs in seconds.
  6. 06Report status from data, not from screens: a running component is not data flowing, and a not-null check passes on an empty table.

Questions this work answers.

How do you reproduce a regulatory figure filed months ago?

Pin every filing to an Apache Iceberg snapshot in a submission register, then query that snapshot with time travel. Exchange rates at the reporting date, counterparties kept as SCD Type 2 versions and reference codes joined as of the date keep the old figure from drifting.

Why keep a raw layer that is never edited?

Because every layer above it can then be rebuilt, and a restatement can be explained: the original record and its correction both stay, so the difference between the filed figure and today’s traces to exact rows.

How does role-based masking work on Cloudera?

Apache Atlas classifies columns as personal data, and Apache Ranger policies written on that classification mask them by role. An analyst and a supervisor run the same SQL and see different values, every read is audited, and a new table that inherits the tag is protected at once.

The service behind this work

All work →

Start with a conversation.

Tell us what you run and what is getting in the way. You get a reply within 24 hours.

Hours
Mon–Fri, 9:00–17:00 ET
Closed on statutory holidays
Office
110 Place d'Orléans Dr
Ottawa, ON K1C 2L9