Tokyo Fintech Overhauled Access Certification
Discover how an APAC-based regulated fintech cut certification setup time from 16 hours to 90 minutes and consolidated 95 individual campaigns into 21 grouped runs with Zluri. Automated audit reporting, Jira-native remediation, and better visibility into orphaned access helped the team streamline compliance and reclaim hundreds of hours each cycle.
The customer is a regulated financial technology company headquartered in the APAC region, operating in the Buy Now, Pay Later (BNPL) segment. Like most regulated fintechs, they face a dual mandate: keep the business moving fast while maintaining the access governance posture that regulators and auditors expect. IT operations are managed by a lean team, the IT Tech Lead and the IT Systems Engineer, responsible for provisioning, identity lifecycle, and the semi-annual access certification cycles that the company's compliance obligations require. Before Zluri, those certification cycles were the team's most painful recurring obligation.
Every six months, the team had to certify access across approximately 95 applications, individually. Each certification campaign covered a single app, meaning one setup per app, repeated nearly a hundred times per cycle.
The IT Systems Engineer describes what that setup actually looked like:
"I really remember copy, copy, pasting all the titles, assigning the assignee for every single application. Then you had prod, staging for the databases... it took so much time just setting up one single app."
Each certification took close to two full working days (~16 hours) to configure. Multiply that across 95 apps and the semi-annual access review cycle consumed an enormous share of the team's capacity, before a single reviewer had even looked at a single account.
Beyond the setup burden, audit evidence was a spreadsheet problem. Reporting required reactive effort after certifications closed: collating data, formatting exports, chasing approvals.
Unused and orphaned accounts, seats held by former employees or inactive users, had no systematic detection mechanism. The team could not easily know which accounts to prioritize for revocation, and consolidating that information required manual effort across multiple systems.
Zluri's UAR module allowed the team to consolidate individual application certifications into grouped campaigns, bundling up to 15 applications per campaign. What previously required ~95 separate campaigns per cycle now runs as ~21 grouped ones.
The structural change alone reduced the volume of certification events by over 75%. But the bigger change was in setup time.
With pre-configured reviewer assignments, global remediation settings, and dynamic variables that auto-populate application details, The IT Systems Engineer can now stand up a certification in minutes rather than days:
"Now I just start a new certification, give it a name, put all apps with the delegate reviewer as a custom field, we have it prefab, right? Once set up and forget, click through it, put a date on it, put the remediations to global ones on it and it's done. So it takes me like five minutes to set up a new review nowadays. "
The 91% reduction in per-certification time, from ~16 hours to ~1.5 hours, is the single most impactful operational change the team has experienced with Zluri.
Once a reviewer completes a certification and marks an account for revocation, the remediation workflow flows directly into Jira. App name, reviewer information, and comments pass through dynamic variables into Jira tickets automatically, with no manual handoff or copy-pasting between systems. This was a natural fit for the team's existing engineering workflow and removed the last manual step from the end-to-end process.
Audit evidence is now produced automatically at the close of each certification: a non-editable PDF with a complete approval and revocation audit trail. What previously required weeks of spreadsheet assembly is now ready at the click of a button: compliant, timestamped, and immutable. For a company operating under regulatory audit obligations, this shift from reactive reporting to built-in evidence generation is a qualitative compliance improvement that the numbers alone don't fully capture.
Across completed certification cycles, Zluri has facilitated 600+ access revocations, accounts that would previously have persisted invisibly. This gave the team clear, ongoing visibility into stale and orphaned access that had no systematic detection before.
Discover how an APAC-based regulated fintech cut certification setup time from 16 hours to 90 minutes and consolidated 95 individual campaigns into 21 grouped runs with Zluri. Automated audit reporting, Jira-native remediation, and better visibility into orphaned access helped the team streamline compliance and reclaim hundreds of hours each cycle.
The customer is a regulated financial technology company headquartered in the APAC region, operating in the Buy Now, Pay Later (BNPL) segment. Like most regulated fintechs, they face a dual mandate: keep the business moving fast while maintaining the access governance posture that regulators and auditors expect. IT operations are managed by a lean team, the IT Tech Lead and the IT Systems Engineer, responsible for provisioning, identity lifecycle, and the semi-annual access certification cycles that the company's compliance obligations require. Before Zluri, those certification cycles were the team's most painful recurring obligation.
Every six months, the team had to certify access across approximately 95 applications, individually. Each certification campaign covered a single app, meaning one setup per app, repeated nearly a hundred times per cycle.
The IT Systems Engineer describes what that setup actually looked like:
"I really remember copy, copy, pasting all the titles, assigning the assignee for every single application. Then you had prod, staging for the databases... it took so much time just setting up one single app."
Each certification took close to two full working days (~16 hours) to configure. Multiply that across 95 apps and the semi-annual access review cycle consumed an enormous share of the team's capacity, before a single reviewer had even looked at a single account.
Beyond the setup burden, audit evidence was a spreadsheet problem. Reporting required reactive effort after certifications closed: collating data, formatting exports, chasing approvals.
Unused and orphaned accounts, seats held by former employees or inactive users, had no systematic detection mechanism. The team could not easily know which accounts to prioritize for revocation, and consolidating that information required manual effort across multiple systems.
Zluri's UAR module allowed the team to consolidate individual application certifications into grouped campaigns, bundling up to 15 applications per campaign. What previously required ~95 separate campaigns per cycle now runs as ~21 grouped ones.
The structural change alone reduced the volume of certification events by over 75%. But the bigger change was in setup time.
With pre-configured reviewer assignments, global remediation settings, and dynamic variables that auto-populate application details, The IT Systems Engineer can now stand up a certification in minutes rather than days:
"Now I just start a new certification, give it a name, put all apps with the delegate reviewer as a custom field, we have it prefab, right? Once set up and forget, click through it, put a date on it, put the remediations to global ones on it and it's done. So it takes me like five minutes to set up a new review nowadays. "
The 91% reduction in per-certification time, from ~16 hours to ~1.5 hours, is the single most impactful operational change the team has experienced with Zluri.
Once a reviewer completes a certification and marks an account for revocation, the remediation workflow flows directly into Jira. App name, reviewer information, and comments pass through dynamic variables into Jira tickets automatically, with no manual handoff or copy-pasting between systems. This was a natural fit for the team's existing engineering workflow and removed the last manual step from the end-to-end process.
Audit evidence is now produced automatically at the close of each certification: a non-editable PDF with a complete approval and revocation audit trail. What previously required weeks of spreadsheet assembly is now ready at the click of a button: compliant, timestamped, and immutable. For a company operating under regulatory audit obligations, this shift from reactive reporting to built-in evidence generation is a qualitative compliance improvement that the numbers alone don't fully capture.
Across completed certification cycles, Zluri has facilitated 600+ access revocations, accounts that would previously have persisted invisibly. This gave the team clear, ongoing visibility into stale and orphaned access that had no systematic detection before.
.webp)
.webp)
.webp)
.svg)
