Paolo Spadafora Email & Phone Number

Milan, It

[Sept 2022 – June 2024] Client: Deloitte Consulting srl project for Kingdom of Saudi Arabia Central Bank "Cyber Threat Led Assessment for Critical Services Execution".• Drafting of the RFIs for the Identification of critical assets• Risk assessment of cyber-attack scenarios• Evaluation of operational resilience, management of remediation plan(s) and final report• Conduct workshops on site with stakeholders to gather knowledge and documentation (technical, functional, operational,etc) for all payment systems in scope - RTGS, Instant Payments, National Card System, Bill Payment• Identify main flows, map assets to flows, analyse and define critical assets• Provide insights on security implementation for the critical assets identified, support cyber security team in defining anddesigning attack scenarios, risk assessment and remediations.• Member organizations include the Central Bank and several Financial Institutions[June 2023 – Oct 2023] Client: Deloitte Consulting srl project for Middle East Government Authority Technical Evaluation of Payment Systems to establish a new Payment Aggregator.• Technical Evaluation of two existing Payment Systems• CMU SEI ATAM Methodology was used for the assessment and evaluation of existing system against the new businessgoals• Conduct meetings to understand the system and gather documentation• Derived “target system” quality attributes based on the new business goals and project objectives• Determine the current system architecture quality attributes and its properties• Determine the system parts to focus the study by analysing the quality attributes requirements• Determine functionalities in scope with the quality attributes scenario approach• Interviews and architecture analysis, present results as risk theme : gaps, trade-off, risks, non risks

[Nov 2020 – May 2022] Client: TAS Group s.p.a. Components of cloud native Global Payment Platform.• Design and lead development team of several “core banking” services part of a cloud-native global payment platform• Accounts, transactions, position keeping, cash pooling, commission service, CBI reports, corporate banking reports, openbanking api through integration with CBI Globe PSD2 gateway for retail and corporate customers• Deployed in production for a Tier 2 Digital Bank on AWS• Initial post-production support and maintenance

[Jan 2022 – July 2023] Client: Deloitte Consulting srl project for Italian National Debit Payment Scheme New Payment System and Card Scheme.• Lead a team of analysts to write the ATM part of a new Card Scheme Rulebook using Nexo Standards and ISOPayments 20022• Review Scheme artifacts delivered by other teams, including architecture designs• Define Rulebook deliverables and its content• Provide guidance and initial work for: implementation guidelines, E2E flows, functional specs, technical scheme requirements• Design and developed of a tool to: starting from XSD ISO schemas automatically generates: templates of message catalogue, REST service interfaces compliant to the ISO guidelines and enriched with message catalogue fields description and business rules, json schemas.[May 2021 – Oct 2022] Client: TAS Group s.p.a. project for Top Italian Paytech Ancillary System connected to TIPS.• Design and Implementation of ACH for Instant Payments connected to TIPS (Ancillary System)• Gather system requirements and participate in meetings with all stakeholders• Define architecture, main design, E2E flows and supervise development team• System covers all ACH areas, including: settlement, liquidity management, reconciliation, TIPS DCA management, EPCreporting, limit and cycles, etc.• System operates also as Instructing Party gateway for some Participants• Architecture offers High Availability in active-active configuration over multiple servers, able to process millions oftransactions per week• Deployed in production, supported the customer in the Certification process and ongoing post-production maintenanceand support

CEO and CTO Fintech start-up Epiphany srl[Feb 2018 – Feb 2021]FSI Marketplace and Platform for the Open Finance.• Accountable for strategic vision and direction, business and product development, sales, client relationships, financialmanagement, solution design and deployment, process improvements, onshore and offshore project coordination,performance metrics, and vendor relations.• Providing leadership in developing, planning and implementing the business plan with shareholders and executives.• Managing all aspects of the teams, including utilization, growth, and development.• Formulating, recommending, and approving the implementation of organization-wide programs, policies, and procedures.• Designed the strategy for new technology platforms. Managed partnerships and external relationships.• Developed new products and facilitated their entry to market.• Build, manage and validate product roadmap, architect solution, inception and plan.• Successfully delivered Open Banking PSD2 Compliant Saas solutions for international customers in production• MVP of first FSI Marketplace and Digital Banking Platform Accelerator with unique features and capabilities (Patent num.WO2021124367A1), OpenShift certified, endorsed by Gartner in their Market Guide• MVP of an Instant Payment mobile app using PSD2 Payment Initiation for Banca Popolare di Sondrio• Content creator, panelist and speaker at industry events, webinars. Including money 2020, EBA Days, BIAN, IBM.• Member of NextGenPSD2 and BIAN working group

[Feb 2015 – Jan 2018] Client: SIA s.p.a.New Payment System - Central Bank of Russia.• Senior Software Architect of the new Payment System for the Central Bank of Russia• Gather system requirements, interview stakeholders to define Quality Attributes• Read and map business requirements• Defined software architecture based on reference architecture, identified appropriate architectural style using SystemArchitecture and Business Architecture• Interact with Business Analyst to convey requirements and functionality into sub-systems to reduce system complexity• Documented software architecture following ISO 42010 using appropriate UML diagrams, define Views, links acrosssections, matrix role/sections, appropriate content and references, artifacts, subsystems, explaining with content• Regularly hold sessions with Central Bank to present artifact and gather feedbacks• Built initial system skeleton, fine grained design of system complex artifact (eg: Settlement & Liquidity) and run PoC toprove system ability to meet SLA, performance of processing large volumes of transactions in a highly concurrentenvironment.• Support development teams, system admins and other stakeholder to align with architecture• Defined application security & monitoring requirements• Built on IBM Stack, Hardware and Software except Oracle as Database. HA configurations to run in Active-Hot standbywith DR region as well as active-active + DR.

[Sep 2013 – Jan 2015] Client: SIA s.p.a.Online Bill Payment Re-engineering – Poste s.p.a.• Bill Payment system refactoring to meet SLA• Analysis of system components to identify issues• design and re-engineering of components with impact on performance or causing system• Deployed in production with reliability and performance KPI in line with defined SLA Protocol Adapter – Société générale• Design and implementation of a message adapter SEPA SDD – ALISE (proprietary format SocGen)• Design of application components and define technical specifications• Coordinate development team• Deploy in production

[Jan 2012 – Jun 2013] Client: SIA s.p.a. Mybank Payments – Preta s.a.s.• Software Architect for "MyBank Payments Directory Service"• Review and contribute to the MyBank Payment Scheme• Understanding requirements, interfacing with business analyst and translating the requirements into application andsystem architecture• Lead the development team, responsible for architecture and design of critical components• Writing UML diagrams and technical analysis, prototypes, testing of design attributes and coordinating with other teammembers• Project included an internal service, owned and operated by SIA s.p.a., "Distributed Security Framework" handling all PKIfunctions, XML Digital Signatures, using Crypto Cards on IBM Mainframes. Designed around the proposed standard RFC5055 “Server-Based Certificate Validation Protocol”• Deployed in production and supported post-production for 2 years• Highly scalable, load balanced, running on zLinux in High Availability “Active + DR” environments• Designed to support multiple payment rails: Direct Debit, Sepa Credit Transfer• Provided maintenance and support supervision until Dec 2014

[Apr 2010 – Sept 2011] Client: CRIF s.p.a.Credit Flow Upgrade - Business Process Outsourcing platform for Loans• Service-Oriented Architecture tailored specifically to streamline the customer acquisition process, a solution supportingloans, credit cards, and other financial products both for retail and commercial business markets.• Planning and assigning tasks to the team while actively contributing to analysis and development of Products and Servicesrelated to Credit Application Processing for banks and financial institutions. Local and offshore development (India)• End to end management and coordination of all phases (Requirements to Release to production)• Release deployment planning and execution of releases• Service-Oriented Architecture tailored specifically to streamline the customer acquisition process, a solution supportingloans, credit cards, and other financial products both for retail and commercial business markets.• Technology JBoss, Weblogic, EJB 2, Axis, SOA, XML, XSLT, Alfresco, SQL Server, Oracle, Struts

[Feb 2009 – Mar 2010] Client: SCAI s.p.a.Doqui & ACTA “ERP for Government Agency” SaaS – CSI Piemonte• Team lead of software development, responsible for analyzing functional specifications and coordinating designers and developers• Managed team activities, including assigning UML design tasks and reviewing work• Provided support, guidance, and verification for development tasks• Oversaw bug fix cycles and client interactions• Supported problem resolution and ensured quality of deliverables• Designed and implemented critical components related to cybersecurity, PKI, digital signatures, etc.

[Sep 2004 – Jan 2009] Client: Intersiel s.p.a. , Finsiel s.p.a. (Now Almaviva Group) Web Based ERP and Digital Archiving - Italian Government• Team lead of software development, responsible for analyzing functional specifications and system design• Managed team activities, provided support, guidance, and verification for development tasks• Oversaw bug fix cycles and client interactions• Supported problem resolution and ensured quality of deliverables• Deployed in production for 2 GovernmentSoftware for Tax Forms – Sogei s.p.a.• Team lead of software development, responsible for analyzing functional specifications and application design• Implemented following strict government requirements• Supported problem resolution and ensured quality of deliverables• Software package freely available on government revenue agency portal

Lead Software Developer[Dec 2005 – Feb 2006] Client: Software House Project: Customer Relationship Management• Team lead of software development, responsible for analyzing functional specifications and system design• 3 Tier application• Managed team activities, provided support, guidance, and verification for development tasks• Oversaw bug fix cycles• Supported problem resolution and ensured quality of deliverables

[Jan 2000 – May 2004]Web Application for Fuel Cards Management - Canada Clean Fuels• Web application for fuel cards managementFleet System - Canada Clean Fuels• Re-engineering of an existing Unix-based system into a modern client-server application for fleet management, integrationwith handset devices.Paid and Controlled Circulation – CLBMedia• Engineered a custom solution upon company acquisition & merge of 4 different publishers. Optimized for fast data entry; reporting and fine grained role based authorization. Planned and implemented data migration and de-duplication.Search Engine – FDEM Law• Created a custom search engine for company documents, enabling easy access to information across multiple branches. Built using Lucene technology, we enhanced it with additional features like fast file processing and search result highlighting