Aasa24 - Mobile Lending App with a Visa Credit Card

In 2023 Aasa Polska needed a native app that would take over the whole loan process from its website and hotline, and later carry a new card product. The hard part was pace. Regulations and the loan offer change every few months, and from 1 January 2024 lending institutions in Poland came under the supervision of the Polish Financial Supervision Authority (KNF), while the project was already running. Work started in May 2023, and the first public release followed in November 2023.

Aasa Polska S.A. is a Warsaw-based lending company with Scandinavian roots, operating in Poland since 2012 and entered in the KNF register of lending institutions under number RIP000127.

Aasa24 leads the customer from the calculator, through the application and the signed agreement, to repayments, documents and harder moments such as payment holidays or refinancing. Customers choose from the Standard, Plus and Biznes loans, from PLN 1,000 to PLN 25,000 for 4 to 36 months (offer as of 10 September 2026).

The native app is built in React Native for iOS and Android, with 84 screens covering more than 20 functional areas, and the same Order Group team develops the backend in parallel. We work in three stages: the loan MVP in 2023, a second stage with the card product in 2024-2025, and continuous development that runs to this day. Since November 2023 the app has had 47 production releases, and the code has changed in every month since the project started (as of September 2026).

Applying for a loan used to mean a multi-page form on the website or a call to the hotline. In Aasa24 it takes 13 short steps with a hint at each one, and the signed agreement arrives on the same phone.

• The calculator uses sliders for amount and period, and Aasa changes its parameters in an admin panel, without an app store release.
• The application takes 13 steps, fills in the address from the postcode and validates each field as the customer types.
• An application started on the website continues in the app, exactly where the customer stopped.
• Income is confirmed with a verification transfer or by logging in to the customer's bank (open banking), instead of a paper certificate.
• The agreement is signed with an SMS code; the agreement, the repayment schedule and the repayment history are available as PDFs.
• After the payout the customer can pay an installment, repay early, take payment holidays, refinance or change contact details without calling the hotline.
• More than 40 application and loan states are translated into plain messages, so the customer always knows which stage they are at.
• Customers log in with a PIN, Face ID or Touch ID, Google, Apple or e-mail.

In the second stage Aasa introduced a card with a credit limit, and the whole card journey runs in Aasa24, from the application to everyday limits. A lending company's app now does what customers know from banking apps.

• The card application includes online identity verification: a document scan and a face check, which the customer can retry.
• The card is ready to pay at once: the PIN is set on the phone, and one button adds the card to Google Pay.
• The customer can block and unblock the card, cancel it, and set daily and monthly limits; every change is confirmed with the PIN.
• The card number and CVV are shown after the PIN and disappear after a moment or when the screen turns off.
• Transaction history shows merchant names and filters, with PDF confirmations, statements, the repayment schedule and reminders about the minimum repayment.
• The card is issued by an external, licensed card issuer in the Visa network, and we integrated the app with it.
• The rollout went in stages: Android and a test group first, with features switched on remotely through feature flags, without a new version in the stores.

A KNF-supervised lender's app must protect data and money while staying out of the customer's way. Biometrics replace passwords, the PIN appears only where money is involved, and sensitive data hides itself.

• Biometrics and an app PIN protect access; login data sits in the system's secure storage, and the app logs the customer out when the session is lost.
• Card data is encrypted and decrypted on the device in our own native module, and the card PIN is never sent in plain text.
• Identity is verified on several levels: KYC with a document scan, the PESEL (Polish national ID number) with an SMS code, and repeated or manual verification in difficult cases.
• Screens with sensitive data are masked in analytics and session recordings, so neither the card number nor the PESEL reaches external tools.
• Marketing consents and cookies are managed per channel in line with GDPR, and analytics starts only after consent.
• External penetration tests were carried out, and the fixes were deployed in 2025.
• We keep the app up to date with App Store and Google Play requirements on an ongoing basis.

Aasa24 measures every step of the funnel, knows which campaign brought each customer, and lets Aasa's marketing team run its own communication.

• The application funnel in Google Analytics and Firebase tracks about 50 events, from registration to the signed agreement.
• AppsFlyer attributes campaigns, and the customer's source is passed on to the application.
• Offline campaigns use a QR code: on iOS an App Clip opens straight from the code without installing the app and carries the source into the full app.
• Deep links from ads, mailings and notifications open the right screen directly.
• SALESmanago delivers push notifications and in-app chat, and the client's marketing team runs the campaigns.
• Aasa's team edits the calculator, documents and messages in a panel.

The project started as an MVP and became a permanent product partnership. The same core of developers has run the app since the first commit, so a new feature or a change forced by regulations never starts with onboarding new people.

• A stable core of 3-4 mobile developers has worked on the app since 2023, supported by backend, DevOps, QA and a PM.
• The team works in a rhythm of planning, daily meetings and retrospectives, with a code review of each of more than 800 pull requests.
• Releases go out every 3-4 weeks on average, and production hotfixes take days.
• CI/CD builds automatically to TestFlight, Firebase and Google Play, runs tests on every change and checks Apple certificates weekly, with an alert on Slack.
• Four major React Native upgrades and the Android and iOS migrations went through without downtime for users.
• More than 1,000 tasks ran in three streams: the build, the card and ongoing development.