A Bahrain-based payments fintech must store transaction records and backups solely in me-south-1 to satisfy national regulation, prevent any cross-Region copies or replication, and provide regulators with continuous evidence of residency. Workloads run on Amazon EC2, RDS and S3 under AWS Organizations. Which architecture enforces Region-specific deployment and transfer restrictions for data residency compliance?

The architecture that deploys all workloads in me-south-1, denies resource creation outside that Region with SCPs, and uses AWS Config is correct because it combines preventive and detective controls: the SCPs restrict regional provisioning for EC2, RDS, S3, and backups, while Config continuously evaluates configuration and retains residency compliance evidence for regulators. Using CloudTrail Lake instead supplies immutable, queryable API activity, but activity history does not evaluate residency posture or provide Config-based compliance recording. Limiting SCPs and Config checks to EC2 and S3 leaves RDS and its snapshots outside the stated guardrails, so not all transaction stores receive coverage. Replicating Config snapshots to eu-central-1 may support central reporting, but it sends compliance evidence across Regions and violates the requirement that records and backups remain solely in me-south-1 with no cross-Region copies. The exam caveat is to distinguish deployment restrictions, transfer restrictions, and continuous compliance evidence: meeting only some of these requirements is insufficient. As a practical check, verify that SCPs deny out-of-Region resource creation and storage replication operations, and that Config recording, delivery, and retention remain active in me-south-1 without outward aggregation of regulated data.