Five Nines Uptime in Financial Services
Key Takeaways
Introduction
Why "Good Enough" Isn't an Option in Financial Services IT
In some industries, a few hours of downtime is an inconvenience. In financial services, it can cost a firm its charter.
Banks, broker-dealers, and insurance companies (the three core categories of financial firms) operate inside a regulatory perimeter that doesn't leave uptime, data protection, or recoverability to good intentions. When regulators get involved, they mandate outcomes. Miss them, and the consequences escalate quickly: fines that go through the roof, or the loss of a banking or broker-dealer charter altogether. As Mitch Martinez puts it, the people running these institutions "don't want to see their salaries go kaput because they didn't listen to the regulators."
That single reality shapes everything about how financial IT gets architected.
The Regulatory Wall Came Down But The Requirements Didn't
For decades, Glass-Steagall kept commercial banking and brokerage separated. Banks couldn't take deposits and pour them into risky securities. Over the last three decades that wall blurred, giving rise to vertically integrated institutions that operate as both bank and broker-dealer behind a wall of internal controls.
Pure-play banks still exist: retail operations that collect deposits, lend them out, and earn the interest spread. But whether a firm is a pure bank, a broker-dealer, or an insurer, the throughline is identical: the regulatory requirements shape the company. That's the starting point for every architecture decision that follows.
What Five Nines Actually Costs You
"Five nines availability" (99.999% uptime) is the industry shorthand for what a resilient financial system is expected to deliver. Do the math and the standard becomes concrete: out of 525,600 minutes in a year, five nines leaves you roughly five minutes of allowable downtime per year.
Five minutes. That's the entire annual budget for a catastrophic flood in a data center, a storage failure, a severed communication line, or a rogue virus.
Uptime isn't just about compute, It's about the whole ecosystem — the public internet, connectivity, the systems themselves, data storage, and every third-party dependency in the chain. Even the end client has to be up; if communications are down at the endpoint, the application may as well not exist.
Resiliency Inside the Building
The same duplication logic applies inside the walls. On each floor of a building, an IDF (intermediate distribution frame) closet holds the switching. For true resiliency, those closets run dual switches with twice the port count needed — so if one switch fails, the other already has capacity for every device. Fiber and router paths out of those closets are duplicated too.
But cost is always something that needs to be taken into account. Not every scenario justifies full active-active redundancy. For an internal access point, you wouldn't run a second line out of a second access point — you’d place a nearby backup access point that traffic can be rerouted to if needed. And where an organization can tolerate a few minutes of interruption, an active-passive setup (a standby switch waiting to take over) is the "poor man's version" that costs far less than fully automated failover. The right level of redundancy is a business decision, not a technical default.
Resiliency Is Layered And Geography Matters
Hitting five nines means engineering redundancy at every layer: communications in and out, compute, storage, and the data itself. The gold standard is an active-active architecture, meaning there are multiple live sites ready to take over instantly. The budget alternative, active-passive, keeps a passive replica receiving data and fails over when the primary dies.
Geography is a design input. Resilient firms deliberately span power grids, communication paths, and time zones (New York paired with Texas, Florida, or Georgia rather than North Jersey). The reason is blunt: if one event could take out both sites, your five nines is already blown.
The Road Matters As Much As The Destination
It's not enough for a backup site to exist, the route to it has to survive too. When a bank resolves to a New Jersey data center and New Jersey goes down, something has to detect that and reroute traffic to Georgia. That's the quiet, critical work of network load-balancing and specialized internet routing companies.
Resiliency therefore has two questions, always in order: What road is available to get me where I need to go? And once I'm there, is the system actually up? Sometimes the answer is a second road to a secondary site. Sometimes it's the same road to a replicated storage system inside the same data center. The architecture depends entirely on the failure.
Latency, Audit Trails, And The Myth That Data Can Sit In One Place
Ask whether critical data can live in a single location and the answer is a flat no, but replication is only as good as your latency. Synchronous replication depends on very low latency to guarantee data integrity right up to the failure point. If your replica is one second behind, that's excellent. If it's five minutes behind, failing over means losing five minutes of transactions, which is unacceptable in a trading or banking context.
This is where audit trails earn their keep. A good audit trail lets you rewind or fast-forward to a known-good point in time and rebuild the system after a failure. Latency and audit trails together are how a firm gets back to a current, trustworthy state.
And "data" is broader than most people assume. It's not just transaction records sitting in DB2, SQL Server, or Oracle. In modern virtualized environments, the state of a machine itself is data. VMware represents every virtual machine as a large, complex dataset, which means the VM can be replicated to a secondary site and spun up to take over from a failed application. You're not just replicating transactions and audit logs; you're replicating the machines that run them.
Cybersecurity, When It's The Law
For a financial firm, security isn't a best practice, it's regulated. A broker-dealer transmitting unencrypted data without HTTPS can expect the SEC to fine them and threaten their existence within a week. FINRA focuses more on protecting individuals' financial data from compromise. The mandates cascade into everyday controls: encryption at rest and in transit, enforced password policies, and multi-factor authentication for unrecognized devices.
The reach extends even to firms that aren't banks. Derive itself, as a Visa- and Amex-approved merchant, operates under PCI requirements. This means that Derive can't store full card numbers, must encrypt anything it does store, and restricts access to a need-to-know basis. If a services company that merely accepts cards carries that obligation, the burden on a regulated bank is an order of magnitude heavier.
What A Firm Gains From A Partner Who Speaks The Language
When Derive engages a financial services client, the work starts with understanding every layer of infrastructure, whether cloud, on-premise, or hosted; communication resilience; application, compute, and storage resiliency; and, critically, the interdependencies between them. Not every subsystem is equally critical, so the assessment maps which components truly can't fail.
From there it's a deep-dive assessment of current resiliency and continuity practices, a hard look at failover and business continuity planning, and concrete recommendations to eliminate single points of failure across communications, compute and storage, applications, and data integrity itself. Because failure isn't always a dead machine or a cut line. Sometimes every piece of equipment is fine and a rogue virus has quietly corrupted the data. To the customer it's still an outage; it's just a failure of data integrity rather than hardware.
The real payoff of a partner who already speaks the regulatory language is speed and trust. You don't spend the first month explaining what the regulations require. The partner who understands resiliency and business continuity in a financial and regulatory context is a step ahead of the specialist who knows storage cold but has no idea what a regulated firm actually needs.
The Takeaway for IT Buyers
The Bottom Line
Latency, audit trails, and data residency are all levers. But they serve one non-negotiable master: meeting the regulatory requirements. End of story. Everything else is architecture in service of that. And because resiliency lives in so many there's an opportunity to get it right, or wrong, at every one of them.
That's exactly where the right partner earns their place. Reach out to learn how Derive can keep you compliant.