Databricks medallion architecture for regulated reporting
NOV. 10, 2026
6 Min Read
Databricks medallion architecture supports regulated reporting only when every layer has a written contract and an audit trail that traces each reported number to source.
Regulators have been asking banks for that traceability for more than a decade, and few can show it end to end. A Basel Committee progress report found that only 2 of 31 global systemically important banks fully complied with its principles for risk data aggregation and reporting. Most of those banks run modern data platforms. What they often lack is a clear, provable path from a figure in a filing back to the record that produced it.
The bronze, silver and gold pattern can supply that path. It does so when each layer promises something specific and the platform records if it kept the promise. Without that, three layers are just three places for numbers to drift apart.
Key Takeaways
- 1. Databricks medallion architecture supports regulated reporting only when bronze, silver and gold each carry a written contract, an owner and a check on every load.
- 2. Unity Catalog lineage turns a reported figure into a traceable path back to source records, which is the question examiners ask first.
- 3. Owned silver definitions and approved gold logic let regulatory reporting, risk analytics and AI models share one set of governed tables.
What medallion architecture in Databricks means for regulated data
Medallion architecture organizes data on Databricks into three layers. Bronze holds raw data as it arrives, silver holds cleaned and conformed data, and gold holds business-ready tables for reporting and analytics. For regulated firms, each layer also becomes a control point where quality and ownership are proven.
Consider a bank's liquidity reporting. Bronze stores the daily position files from treasury systems exactly as received. Silver standardizes currencies, maps counterparties to a single identifier and removes duplicates. Gold produces the liquidity coverage figures that feed the regulatory return.
The pattern is simple to describe and easy to get wrong. The layers themselves don't create trust. It's the rules and evidence attached to each one that do.
Why layer names alone fail a regulatory audit
An examiner doesn't ask which layer a table sits in. They ask how a reported number was produced, who approved the logic and what checks it passed. Layer names don't answer any of those. A gold table with no owner, no documented transformation and no quality history fails the same way a spreadsheet does.
"The layers themselves don't create trust."
Picture an insurer asked to explain a jump in reported reserves. The gold table shows the new figure, but three teams changed silver logic that quarter and none recorded why. The data engineers can rebuild the answer, given a few weeks. The regulator wanted it in days, and the delay itself becomes a finding.
What each layer must guarantee for regulatory reporting
Each medallion layer needs a contract stating what it guarantees, who owns it and how that guarantee is checked on every load. The contract turns the layer from a storage location into a commitment that downstream reporting can rely on and that an auditor can test.
The guarantees differ by layer and by who depends on them.
| Layer | What it guarantees | How the guarantee is proven |
|---|---|---|
| Bronze | Every source record arrives complete and unchanged, with its load time. | Row counts and file checksums are compared against each source system on every load. |
| Silver | Records follow agreed definitions, identifiers and data types across sources. | Expectations reject or quarantine records that break the conformance rules. |
| Gold | Reported metrics follow approved business logic with a named owner. | Logic changes go through review, and the approved version is recorded. |
| Across layers | Any reported figure can be traced back to its source records. | Unity Catalog lineage links each gold column to the tables that fed it. |
| Access | Sensitive fields stay visible only to approved roles in every layer. | Column masks and row filters apply the same policy to people and tools. |
Ownership is the guarantee teams skip most often. A silver table shared by risk and finance needs one owner who approves definition changes, or both teams will edit it. The two reports then diverge by a few basis points each quarter. Nobody notices until an examiner lines them up side by side and asks which one is right.
How lineage traces a reported figure back to source
Lineage is the record of which tables, columns and jobs produced a given output. On Databricks, Unity Catalog captures it automatically for workloads that run on the platform. That lets you follow a reported figure from a gold table back through silver to the bronze records that started it.
Take a capital adequacy report. The risk-weighted assets column in gold traces to a silver exposures table, which traces to bronze loan and collateral files from three source systems. When a reviewer questions a figure, the team opens the lineage graph and the job history. The path from filing to source then takes minutes to show.
Lineage also matters for change. Before you alter a silver definition, you can see every gold table and report that depends on it.
Shared definitions sit underneath all of this. Databricks argues in its piece on data ontology that governed business definitions are the context layer AI agents are missing. For regulated reporting, that means defining exposure, counterparty and reporting date once in silver, so the regulatory return and any AI model read the same meaning.
When medallion architecture fits regulated reporting best
Medallion architecture fits best when several source systems feed the same regulated figures and the firm must prove how they were combined. It's less useful for a single, already clean source with one consumer, where the extra layers add cost without adding proof.
A wealth manager consolidating client holdings from custodians, a trading platform and a legacy portfolio system is a strong fit. Each source has its own formats and identifiers, and the regulator expects one reconciled view. A team reporting a single operational metric straight from one well-governed system can often skip silver. The test is simple. Each layer has to add a guarantee someone actually needs.
Medallion architecture practices that hold up under examination
The practices that survive examination are the ones that produce evidence without extra effort at audit time. They make quality checks, ownership, change approval and lineage part of how pipelines run each day, so the audit pack comes from a query you can run any day.
Five practices do most of that work.
- Keep bronze append-only so the original record always survives
- Write data quality expectations for every silver table
- Name one accountable owner for each gold table
- Version gold logic and record who approved each change
- Retain job history for as long as reporting rules require
"A credit risk model and the regulatory return reading the same governed exposures table will never disagree about the number."
Lumenalta®'s specialist teams build these controls into delivery, so decision traceability and compliance controls are in place before the first report runs. Adding them after a finding costs far more. Retrofitting expectations onto hundreds of silver tables means rerunning history, and that's the moment you discover which records never met the rule.
Building reporting data that risk and AI teams can share
A well-contracted medallion design serves more than the regulatory return. Once silver definitions and gold logic are owned and traceable, risk analytics, finance and AI teams can all build on the same tables. They avoid recreating them, and each new use inherits the controls already proven.
That shared foundation is where the real return sits. A credit risk model and the regulatory return reading the same governed exposures table will never disagree about the number. When one changes, lineage shows the effect on the other. Lumenalta® implements medallion designs on Databricks that reporting, risk and AI teams can all trace back to source, with the contracts written before the pipelines.
Table of contents
- What medallion architecture in Databricks means for regulated data
- Why layer names alone fail a regulatory audit
- What each layer must guarantee for regulatory reporting
- How lineage traces a reported figure back to source
- When medallion architecture fits regulated reporting best
- Medallion architecture practices that hold up under examination
- Building reporting data that risk and AI teams can share
See how Databricks medallion architecture makes regulatory reporting faster and easier to defend.