Accelerating Evolution: Inside Itaú Unibanco’s Mainframe Leap to AWS

Itaú sought better agility and team autonomy to innovate with reusable solutions. It expected to achieve higher delivery frequency with shorter design cycles and improved time-to-market.

Over more than five decades, Itaú built a mainframe estate running COBOL, IMS, CICS, Db2, TPF Assembler, PL/I, and a proprietary transaction manager sustaining its business operations. With millions of instructions per second, the company has one of the world’s largest mainframe footprints. “With our challenge to modernize 100% of our mainframe legacy of 50 years, we realized traditional migration approaches weren’t going to be enough,” said Santos. “To discover all the dependencies and understand all the business rules, we were spending 50% of our engineering team’s time analyzing what this code does.” Itaú spent 30% of its engineering time on manual test creation.

Itaú had billions of lines of code buried in COBOL scattered across online and batch resources, misplaced rules belonging to other domains, and scarce documentation. “Over time, the knowledge concentrated in a few specialists is lost as those people retire or move on with their lives,” observed Santos. It also had monolithic programs with intertwined functions it sought to decompose into microservices.

Itaú considered a complete mainframe migration to the cloud driven by three forces: the need to stay competitive in a scenario where customers are increasingly demanding and seeking hyper-personalized experiences; cost containment; and the risk that keeping the legacy running alongside the modernized environment could pose to the customer experience. Additionally, with COBOL specialists retiring, the company lacked a specialized mainframe workforce. In November 2020, Itaú selected AWS as its long-term strategic cloud provider.

Itaú's mainframe organization is structured around "communities" -- autonomous, multidisciplinary business units that own their own applications end to end, from development to the decision on when and how to modernize. This model gives each team the autonomy to move at its own pace, without waiting for a central program to dictate priorities. Over 88 consuming communities operate across its mainframe estate. The company adopted AWS Transform for mainframe for reverse-engineering and cross-platform rules extraction.

The project had three workstreams: application-level business rule extraction, automated test generation, and reimagine transformation.

Reimagine is different from replatform and refactor patterns in that it's usually done at an individual scope. Instead of migrating an entire system at scale, customers focus on important application features, enabling more frequent deployments, and gaining new business functionality. Instead of centralized governance, each community owns its own modernization path.

The company modernized most of its business applications including direct debit authorization within its payments domain. The company created a validation framework to ensure all business-critical logic is available for the forward engineering process.

Itaú used AWS Transform for mainframe to perform automated code analysis, dependency mapping across hundreds of individual programs and application-level business rule extraction. The tool captured rules scattered across CICS, IMS, and batch programs, including misplaced rules belonging to other domains. These rules were then updated to meet current business needs before being used in the modern applications specifications. The same platform reverse-engineered the bank's COBOL, IMS, CICS, and Db2 systems, while Kiro handled forward-engineering into Python/Java code. "We used Kiro to forward-engineer our COBOL programs into Java. We found the tool to be quite versatile," said Santos.

The extracted business rules were then loaded into Kiro for forward-engineering, which generated cloud-native microservice architectures, API specifications, and production-ready Java code following Itaú's coding standards. The generated code passed its CI/CD pipeline criteria (SonarQube and Veracode) on the first iteration. AWS Transform is already available across all 88+ communities as the standard modernization toolchain, while Kiro has been adopted in selected applications.

Itaú has thousands of business services now running on AWS, largely reducing on-premises infrastructure. Critical client-facing incidents dropped 99% over six years, and the frequency of production deployments increased by almost 3,000%.

“Application discovery time that previously consumed three months was completed in two weeks using AWS Transform and Kiro.” 

Douglas Santos, Mainframe Platform Executive, Itaú Unibanco

Key results:

• Business rule extraction: Cross-platform rules extraction spanning CICS online transactions, IMS entry points, and batch programs previously required weeks of subject matter expert interviews. The process now takes hours. These rules were then updated to meet current business needs before being used in modern applications specifications.
• Testing: Manual test case creation was replaced with automated test generation, cutting unit test creation time by around 97% and enabling functional test cases to be generated automatically, while reducing testing effort by 30%.
• Forward engineering: In the applications where AWS Transform and Kiro were used together, end-to-end migration time was reduced by around 75% per application.

“Now we’re using the validated AWS Transform modernization toolchain across all 88+ communities, converting the remaining mainframe MIPS to cloud-native services, and are well on track to retire our mainframe estate by the end of 2028,” concluded Santos.