Enterprise Data Masking for Secure AI and System Development at a National Bank

Overview

A national bank in the Asia-Pacific deployed an enterprise data masking platform to address a critical gap between data quality and data security in its non-production environments. The deployment was initially scoped to support a major credit risk system migration and has since expanded toward an enterprise-wide rollout covering mainframe systems, cloud data platforms, and digital banking programmes.

Institution Profile

The institution is a full-service retail and commercial bank in the Asia-Pacific region, subject to prudential regulation by its national banking authority, managing a complex technology estate comprising on-premises mainframe and Hadoop systems, cloud data platforms, and a growing portfolio of digital banking services.

Business Challenge / Pain Points

• Customer PII, PCI, and business-sensitive data remained unmasked in lower environments which poses a risk issue.
• Testing data was refreshed only once a year, leaving quality engineering teams working against a static, outdated dataset.
• Hard-masked data with no referential integrity caused pipeline failures and costly rework for developers.
• Teams duplicated data access efforts and tooling across projects, with no unified enterprise solution to address data de-identification at scale.

AI Solution Implemented

The bank deployed DataMasque, a dark-site data masking platform, to support its credit risk system migration from an on-premises SAS environment to a cloud-based version. The solution masked sensitive columns from the bank's Hadoop Distributed File System and delivered masked data to lower environments, enabling a third-party vendor to test all pipelines without accessing real customer data. Using a combination of meta-data, in-data discovery, and a fine-tuned, locally-deployed small language model, DataMasque found where sensitive data were located across the file system. DataMasque then created "synthetically identical”, format- and referential-integrity-preserving masked values to maintain data quality. The masking process was driven by a  one-way, irreversible SHA-512 salted hashing to prevent reverse-engineering. The entire process took place in the bank’s environment with zero PII leaving the secure zone. The bank's longer-term plan is to mask data at source across mainframe systems, feeding a unified Snowflake data layer for data engineering, analytics, and MLOps without requiring dynamic masking policies downstream.

Key Benefits & Outcomes

• The open regulatory risk issue was successfully closed after the bank demonstrated effective data masking, directly reducing the CIO's risk portfolio.
• The third-party vendor successfully tested all credit risk pipelines, including risk-weighted assets and expected credit loss computations, using production-realistic masked data with full referential integrity, eliminating prior pipeline failures and rework.
• Data refresh cycles are planned to shift from annual to daily, weekly, or monthly cadences, significantly improving data currency for development and testing teams.
• A single enterprise platform now addresses data de-identification across all teams, systems, and projects, removing the need for duplicated tooling and custom scripts

User Impact

End users required only two to three hours of training, with the interface described as intuitive and accessible to non-technical users. Developers reported that readily available masked data in lower environments significantly reduced friction and rework caused by data integrity failures under the previous approach.

Compliance & Risk Benefits

The dark-site deployment model, with no internet-facing components and no external calls, was assessed as low risk by the bank's cybersecurity team. The platform supports de-identification requirements across GDPR, HIPAA, ISO 27001, the Australian Privacy Act, and other frameworks, ensuring sensitive data never leaves the institution's secure zone.

Implementation Insights

The proof of concept ran for approximately six weeks, with full deployment completed within two months following commercial and regulatory approvals. Infrastructure requirements were minimal, with virtual machine setup estimated at approximately half a day. The dark-site architecture was the key factor that simplified cybersecurity review and accelerated internal approval. DataMasque's 90-day hypercare engagement model, where Solution Architects work directly with the institution's team, supported a smooth and structured implementation.