Execution playbook

From good ideas to a regulated platform that ships

You have the licence, the ideas, and the people. I bring the execution: the method, the architecture, and the delivery rhythm that turn good ideas into a platform that leads its market. I built this playbook and used it in 2026 as CTO of Assetera, a MiFID II licensed investment firm, where it took the company from an inherited platform to a rebuilt stack in production in four months.

When it applies

If three or more of these sound familiar, the problem is not the people. It is the missing system around them.

Good ideas on the roadmap for months, but nothing reaches production.

No shared definition of done. Priorities are set in conversations nobody wrote down.

Deploys from laptops or the IDE. Few tests. No rollback procedure.

Infrastructure clicked together in a cloud portal. Nobody can rebuild it.

Compliance controls that exist on paper but are hard to prove in the system.

Regulator requests come with deadlines in hours. The evidence takes weeks to collect.

Agency or contractor churn. The knowledge left with the people.

The phases

Each phase unlocks the next. The rebuild runs in parallel from the first month, because a regulated business cannot pause while its platform is replaced.

00Audit

Weeks 1 to 2

Everyone sees the same picture.

Read every repository, every cloud subscription, every vendor contract, and every open regulatory obligation.
Sort the findings into two groups: what a working delivery process fixes by itself, and what needs its own budget and sponsor (contract audits, cloud tenancy, legal mapping).
One briefing for the executive team, one for the engineers. Same facts, different altitude.

01Lights On: a delivery cadence

Sprint 1 onward

We can see the work.

One sprint length per team. Planning, daily, review, and retro on the calendar.
A Product Owner per stream and one force-ranked backlog per product.
Definition of Ready and Definition of Done, written down and used in every refinement.
Engineering, product, compliance, and operations refine together. Stakeholders see working software, not slide updates.
No new tools and no new headcount. The change is how the same people work.

02Power Up: engineering foundations

Months 1 to 3

We can ship safely.

Floor: linter, formatter, branching, conventional commits, a README that works.
Visibility: PR template, CI required to merge, CODEOWNERS, first tests.
Confidence: continuous delivery to staging, a review SLO, observability, a rollback button.
Durability: ADRs, integration tests, docs as code. Knowledge outlives people.
Measurement: DevOps (DORA) metrics feed the retro.
The next step starts when the team says the last one "just happens now". The signal is a feeling, not a date.

03Rebuild by decision

In parallel, from month 1

The platform matches the licence.

Write the target architecture as ADRs: one decision per record, dated, in a repository, reviewed like code.
Put the cloud estate into code first, so every later change is reviewable, repeatable, and portable.
Build new rails next to the legacy system, move clients in a guided way, then switch the old estate off step by step.
Treat compliance as product: KYC, AML, appropriateness, and record keeping get owners, tests, and ADRs.
Use AI agents for the reading and the typing. Keep architecture, acceptance criteria, and review with people.

04Dial In

From month 3

Improvement compounds.

Lead time, deploy frequency, change failure rate, and time to restore are on a dashboard anyone can read.
Each retro asks which number moved and why. The team picks one experiment for the next quarter.

The regulator's questions, answered in the system

Compliance is cheapest when the evidence is a side effect of how the platform works. This is how the rebuild at Assetera maps to what a supervisor asks for.

MiFID II record keeping

An activity ledger of orders and client events, built for MiFID II record keeping, and one audit stream for admin actions that fails closed: if the audit write fails, the action does not happen.

DORA ICT risk management

The whole estate as OpenTofu code, separate environments and key vaults, keyless deploys with OIDC, image promotion from testnet to production, and a written rollback procedure.

DORA third-party risk and exit plans

Every vendor choice recorded as an ADR with its alternatives. Infrastructure as code keeps the exit plan realistic, not theoretical.

KYC, AML, and appropriateness

Gates enforced on the server and on-chain, not in the browser. EDD workflows, wallet screening, proof of funds, and appropriateness tests built into the onboarding flow.

Change management

Every change goes through a reviewed pull request with CI and a named code owner. The paper trail is a side effect of how the team works.

What it produced at Assetera

4 mo

From inherited platform to rebuilt stack in production

950+

Pull requests merged, my own, across 29 repositories

Architecture decisions recorded

~15

Services and 4 environments, all defined in code

Findings in the external audit of the settlement contracts

High

Auditor's rating for documentation and test suite

The details are in the case studies: the platform rebuild, the Azure estate as code, compliance by design, and AI-native engineering.

Is your firm in this position?

If you run a payments, brokerage, or investment firm that wants to enter or grow in the European market, and the technology is the part that holds you back, I would like to hear about it. Email me at me [at] thomaswiesner.com or reach out on LinkedIn. Behind each phase sits a full set of workshop and training material that I bring into the team after I join.