apidays Paris 2025 | API Layer7 Security: Real-World Use Cases (BBVA & Nexi)

API Layer7 Security by Broadcom, A overview of Customer Use Cases
Speakers:
Paloma Reyes, Software Architect at BBVA Technology
Valerio Dalessandro, Head of Digital Customer Security at Nexi

A technical deep dive into API security implementation using Broadcom Layer7. This session features architectural insights from BBVA Technology and Nexi, focusing on how leading financial institutions secure their API ecosystems.

What’s Covered:
• Implementation Strategies: How BBVA and Nexi deployed Layer7 to secure digital customer journeys.
• Success Metrics: Realized benefits vs. initial expectations in high-stakes environments.
• Problem Solving: Addressing specific security challenges and unforeseen technical advantages.
• Future Roadmap: Strategic scaling of API security infrastructure beyond 2025.

------------------------------------

Conference Details:
Conference: apidays Paris 2025, part of FOST (Future of Software Techonologies)
Theme: The APIs meet AI Conference: Innovation, Security, Sovereignty, Sustainability
Date: 9 - 11 December 2025 • CNIT Forest, Paris

--------------------------

Resources from apidays:
Join our upcoming conferences: https://www.apidays.global/
Read the latest API news: https://www.apiscene.io
Explore the API Landscape: https://apilandscape.apiscene.io/

Transcript

1. 1 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. December 2025 API Channel Platform The Channel to BBVA’s Embedded Finance Ecosystem
2. 2 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | 1 Título presentación APIs are not just about technology. They’re about improving customer experience. 2 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. |
3. 3 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | What is BBVA? More than 80m customers worldwide Over 25 countries Financial institution headquartered in Spain
4. 4 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | BBVA Values and commitment Client perspective Digital innovation & transformation We are a team 4 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. |
5. 5 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Program • Enables financial products and services • To be integrated directly into third-party platforms Goal • Let users access banking capabilities • Let access exactly where users need • Inside apps, business tools or digital ecosystems • Without needing to visit the bank Embedded Finance 5 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. |
6. 6 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Platform, we serve as the technical foundation APIs to be published securely and consumed externally. We are the bridge between the bank’s internal services and the outside world API Channel is both a platform and an architecture team Team, we design and operate the global architecture Multiple BBVA Geographies, Spain, Perú, Italy, Colombia, Germany…Broadcom’s Layer7 suite, API Gateway and API Portal Kubernetes environment and microservices 6 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. |
7. 7 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Mission Enforcing global security standards Make it easy and safe for partners to consume APIs Make it easy and safe to publish APIs Accelerating time to market Services meet highest standards of governance 7 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. |
8. 8 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | We are the technical platform and the architectural team that enables this vision to work across BBVA
9. 9 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | The reality of corporate treasury today: • Too many portals • Too many files • Too many manual steps • Too much risk • Not enough time for strategic work Use Cases
10. 10 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Use Cases How do we use Layer7 in BBVA? Real-time account balances pulled directly into their ERP. Payment initiation APIs for SEPA or local transfers–executed straight from SAP Cash flow visibility, with instant reconciliation and fewer errors.
11. 11 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Use Cases
12. 12 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Use Cases
13. 13 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Use Cases Spain Funds Confirmation PSD2 Confirm the availability of funds in an account Spain Payments PSD2 Complete your solution by including an option for customers to initiate payments Spain Accounts PSD2 Harness the full potential of the European payment services directive Thatʼs compliance. Thatʼs experience. Thatʼs API Channel.
14. 14 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Benefits Journal El Mundo source
15. 15 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Benefits Security, we install Layer7 to enforce OAuth2.0, mTLS… Ensuring enterprise-grade governance Flexibility use Layer7 to make customizations. Easy to integrate in our ecosystem with microservices Simple design from outside but behind the scenes we orchestrate CI/CD pipelines, logging, quota policies… Developer friendly zero need for them to write policies manually. Behind sits a powerful platform.
16. 16 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | 16 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | KPIs are not just technical, they are business aligned These metrics help us optimize and continuously evolve. Time Build Deployment Time from build to deployment (measured via CI/CD) APIs reused APPs & Partners Time from build to deployment (measured via CI/CD) Uptime, response times and fallback effectiveness Error Rates & SLA Error rates and SLA violations per geography
17. 17 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | 17 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | API CHANNEL one piece of BBVA ecosystem API Channel is just one piece of a much larger ecosystem at BBVA. We’re not the product team, we’re not the business team—we’re the bridge between them. We enable BBVA teams to expose their APIs. We help partners embed them. We standardize, secure, and scale. • When someone initiates a payment in a third-party app • Confirms funds in real-time, or reconciles a treasury report automatically
18. 18 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | 18 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Paloma Núñez Reyes Software Architect Ignacio Aceves Mora-Rey Architecture Senior Expert Beatriz Gutierrez Castro Architecture Principal Manager We’re there, in the background, making it possible
19. We expose possibilities
20. 20 Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. | Broadcom Proprietary and Confidential. Copyright © 2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Thank You