# Fintech Software Development Services Source: https://ordergroup.co/fintech-software-development/ Last updated: 2026-10-23 > Custom fintech software development services for KNF-supervised lenders: loan apps, self-service, KYC, cards and core integrations. Aasa24, AvaFin. # Fintech software development for regulated lenders A wrong amount or a stuck application reaches the borrower directly. We build the customer side of regulated lending: loan app, self-service, KYC and core system integrations, for Aasa24 and AvaFin Poland, both supervised by the Polish Financial Supervision Authority (KNF). [Book a free consultation](https://ordergroup.co/contact-us/) Tell us what you're building. Tell us about your product. We reply within 48 hours on business days. - [![BizBot](https://ordergroup.co/media/images/bizbot-mono_StdJIUN.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/bizbot-fintech-ux-design/) - ![AASA24](https://ordergroup.co/media/images/aasa24-mono.max-208x64.format-webp.webp) - [![AP-Tech](https://ordergroup.co/media/images/ap-tech-mono_ihuJP5T_6b2rSSb.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/monster-airport-lighting-system/) - [![Enerace](https://ordergroup.co/media/images/enerace-mono_FKuME1X_Fp3WF4B.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/enerace-energy-trading-software/) - ![Filmgrail](https://ordergroup.co/media/images/filmgrail-mono_gPdfbHO.max-208x64.format-webp.webp) - [![Kyoto Group](https://ordergroup.co/media/images/kyoto-group-mono_hlqECHG.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/kyoto-digital-twin-software/) - [![RAW Cyber](https://ordergroup.co/media/images/raw-cyber-mono_M2DWvZf_pHEQtjP.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/raw-cyber-custom-android-os/) Lenders under KNF supervision **2** Aasa Polska (Aasa24) and AvaFin Poland Loan application steps **13** to apply for a loan in the Aasa24 app Application and loan states **40+** reaching customers as plain messages First public release **Nov 2023** of the Aasa24 app for customers ## Lending software for lenders that already have a core system At a lender with its own core system, the borrower meets the app, not the core system. The core system sets the prices (including the [APR](https://ordergroup.co/glossary/apr/)), decides on credit, keeps the loan book and runs collections and the contact strategy, and an external provider verifies identity. We are a fintech software house for regulated lenders, and we build the app side for Aasa Polska (since May 2023) and AvaFin Poland, both [loan institutions](https://ordergroup.co/glossary/loan-institution/) under KNF. The product view of this work is on our [loan origination software](https://ordergroup.co/fintech-software-development/loan-origination-software/) and [loan management software development](https://ordergroup.co/fintech-software-development/loan-management-software-development/) pages. ### What the app side includes - The app for iOS and Android in [React Native](https://ordergroup.co/services/software-development/mobile-apps-development/), with the loan calculator, the application flow, the account area and the card, developed continuously. - The backend of the app and an admin panel where Aasa's team changes calculator parameters, documents and messages without a release in the app stores. - Integrations with the core system, [open banking](https://ordergroup.co/glossary/open-banking/) account checks, the [KYC](https://ordergroup.co/glossary/kyc/) provider and the card issuer. - Consent handling, analytics and the protection of sensitive data. ## What we build, in the order the borrower meets it [Application and payout The AvaFin calculator shows guests and signed-in customers the amount, period, cost, APR, repayment date and promo codes. Prices come from the same engine as the core system, so the amount in the app matches the agreement. AvaFin's core system also sets the order of the application steps and the app displays them, so changing the steps needs no new app version. In Aasa24 the 13-step application uses open banking and contract signing by SMS, and 40+ states reach the customer as plain messages.](https://ordergroup.co/glossary/loan-origination-system/) [Identity and bank account checks Aasa24 verifies identity on several levels: KYC with a document scan, the PESEL number (the Polish national ID number) confirmed with an SMS code, and repeat or manual verification in difficult cases. Checking the PESEL restriction register, a flag people set against identity theft, is a step of the application with its own status. AvaFin customers verify a bank account by bank login or a verification transfer, at registration and in the application.](https://ordergroup.co/glossary/kyc/) [Servicing after payout In Aasa24 the borrower pays an installment, repays early, takes payment holidays (since November 2023) or refinances (since August 2024) without calling the hotline. The agreement, the schedule and the repayment history come as PDFs. In AvaFin a loan extension is its own flow: the customer requests it, follows its progress and can cancel. Some types ask for a document or a guarantor's statement from the camera or files, and the offer disappears once the last loan is repaid.](https://ordergroup.co/glossary/loan-extension/) [Payment card in the lending app Between July 2024 and January 2025 Aasa24 added a Visa payment card with a renewable limit, issued by a licensed partner in the Visa network. We built the app, the backend and the integration with the issuer's systems. The card application includes an online identity check with a document scan and its own KYC status. A customer can retry after a negative result, and an application rejected after three failed attempts never locks the customer out of KYC on a new one.](https://ordergroup.co/glossary/card-issuing/) [Arrears and borrower self-service In arrears we build what the borrower sees: how much is due and how late it is, a payment, and the extension and holiday options above. The AvaFin account area shows the amount to repay, the due date or the delay, the loan history with documents and repayment proposals. In Aasa24 an installment is marked as paid by rules agreed with Aasa, and the Pay button appears only when there is something to pay.](https://ordergroup.co/glossary/debt-collection/) ![Loan app registration flow – citizenship question and account creation form on two iPhones](https://ordergroup.co/media/images/iphone_16_pro.format-webp.width-1800.webp) ![Loan app KYC flow – bank account verification screens on two smartphones](https://ordergroup.co/media/images/avafin_kyc_process_1x_dbKNhTV.format-webp.width-1800.webp) ![Card payments integration (Unsplash)](https://ordergroup.co/media/images/photo-1556742049-0cfed4f6a45dfmj.format-webp.width-1800.webp) ![Mobile banking app – virtual card dashboard and PIN setup screen on iPhone](https://ordergroup.co/media/images/aasa_app_card_1x_OuDeh2x.format-webp.width-1800.webp) ![Person using a banking app on a smartphone with a payment card next to a laptop](https://ordergroup.co/media/images/photo-1596843720750-7de9329da5d7.format-webp.width-1800.webp) ## The technology stack behind a lending app The technical stack of the Aasa24 and AvaFin apps, layer by layer. | Layer | What we use | Where | |---|---|---| | Mobile app | React Native on iOS and Android with TypeScript, Redux Toolkit and Axios | Aasa24 | | Mobile app | React Native with Expo and TypeScript, custom plugins in Expo Prebuild, Styled Components, Lottie animations, Redux Toolkit with RTK Query, Expo Router, React 19 and React Compiler | AvaFin | | Code structure | Domain modules, with domain models kept apart from API contracts | AvaFin | | Integrations | Every integration passes through a data mapping layer, so a change in a partner's API does not spread through the app | AvaFin | | Backend | Python, Django with Django REST Framework, PostgreSQL and Celery | Aasa24 | | Infrastructure | Docker and AWS managed with Terraform | Aasa24 | | Monitoring | Firebase in the app, Sentry on the backend | Aasa24 | | Sign-in | PIN, Face ID or Touch ID, Google, Apple and e-mail | Aasa24 | | Sign-in | PIN and biometrics after sign-in, with credentials in the system's secure storage | AvaFin | | Tests | React Testing Library and Jest for components, PyTest with data factories for the backend | Aasa24 | | Quality gates | Every commit passes formatting, lint and type checks, and every pull request runs lint, TypeScript and unit tests in CI | AvaFin | | Delivery | Fastlane and GitHub Actions build the app and ship it to iOS and Android | Aasa24, AvaFin | | Test builds | Every merge sends a test build to Firebase App Distribution and TestFlight (EAS) | AvaFin | | Environments | Production and development Firebase environments are separate, with values swapped at deployment | AvaFin | | Feature flags | Card features were switched on remotely, first on Android and in a test group, and the marketing chat went live behind a flag | Aasa24 | | App as a sales channel | The application funnel is measured in Google Analytics and Firebase, and AppsFlyer attributes campaigns | Aasa24 | | App as a sales channel | An App Clip on iOS carries the customer's source into the full app, and deep links from ads, e-mails and notifications open the right screen | Aasa24 | Show all rows (17)Show fewer rows ## The systems and providers a lending app talks to The ecosystem around the app: what it connects to, and how. | System | How the app connects | Where | |---|---|---| | Core system of the lender | The app calls its API for loan data, statuses and calculator parameters; Aasa24 handles an unavailable core system without losing the customer's data | Aasa24, AvaFin | | Open banking | Kontomatik, an open banking provider: bank login and sharing of account history in registration, in the application and when the customer changes the account in the profile | AvaFin | | Open banking | Bank data supports the affordability assessment and fills in applications automatically | Aasa24 | | Payments | Autopay, a payment gateway: one gateway serves the verification transfer and repayments | AvaFin | | Payments | Repayments run through Autopay and handle a change of the amount due | Aasa24 | | Identity verification | An external identity verification platform | Aasa24 | | Card issuer | A licensed partner in the Visa network | Aasa24 | | Marketing automation | A platform with chat and push notifications | Aasa24 | | Customer support | A chat embedded in the app, available offline and from the lock screen | AvaFin | | Analytics | Campaign attribution and product analytics use a closed event catalogue with no personal data | Aasa24, AvaFin | Show all rows (10)Show fewer rows ![Signing a loan agreement (Jakub Zerdzicki, Unsplash)](https://ordergroup.co/media/images/photo-1763729805496-b5dbf7f.trim.format-webp.width-2880.webp) ## Regulatory requirements behind a lending app Several EU and Polish requirements shape how a lending app has to behave between 2025 and 2027. We build the software side: each requirement ends up in a screen, a consent or a verification step. The legal reading of these rules, and the compliance of the lender's process with them, stays with the lender's lawyer. ### CCD2, from November 20, 2026 National rules implementing [CCD2](https://ordergroup.co/glossary/ccd2/), the new Consumer Credit Directive (Directive (EU) 2023/2225), apply from November 20, 2026 (Article 48). As of October 2026 Poland has not published an implementing act, and on May 27, 2026 the government withdrew the draft consumer credit act (UC82) from the work of the European Affairs Committee. The requirements that show up in software: - Every piece of advertising carries the cost warning (Article 8). The information form must stay legible within the limits of the medium (Article 10(6)), which we read as legibility on a phone screen. - Pre-ticked boxes do not count as consent (Article 15). An add-on cannot be a condition of getting the loan (Article 14), and a loan is not granted without the customer's request (Article 17). - The lender documents the credit assessment, and after an automated assessment the consumer can ask for human intervention (Article 18). - In arrears, the lender applies reasonable forbearance before enforcement, detects customers in financial difficulty early and refers them to debt advice (Articles 35 and 36). Our [article on CCD2 in the loan application flow](https://ordergroup.co/blog/ccd2-lending-app-loan-application-flow/) goes through these requirements step by step. ### AMLR, from July 10, 2027: what a KYC integration has to absorb The [Anti-Money Laundering Regulation](https://ordergroup.co/glossary/amlr/) (AMLR, Regulation (EU) 2024/1624) names two routes for identity verification in Article 22(6): an identity document, or an electronic ID at a substantial or high assurance level, together with qualified trust services. A verification transfer or a bank login confirms a bank account, and neither is on that list. A [KYC](https://ordergroup.co/glossary/kyc/) integration that can absorb the change keeps verification methods in backend configuration, records every attempt and keeps the documentation for five years. Waiting, rejected and manual-review cases each get their own status, and the retry rules are easy to change. Our article on [AMLR and KYC in lending apps](https://ordergroup.co/blog/amlr-kyc-lending-apps/) covers the change in detail. ### Consumer credit law and supervision today Loan institutions in Poland have been under KNF supervision since January 1, 2024, under the anti-usury act, and the number of active institutions has fallen from about 500 to about 100, according to PAP. Until a new act arrives, the act of May 12, 2011 on consumer credit applies: creditworthiness assessment before the agreement (Article 9), a check of the [PESEL restriction register](https://ordergroup.co/glossary/pesel-restriction/) before every agreement and every change that increases debt (Article 9b) and the information form on a durable medium (Articles 13 and 14). ### Distance financial services and accessibility Directive (EU) 2023/2673 on financial services concluded at a distance applies from June 19, 2026 and brings a right-of-withdrawal function for agreements concluded through an online interface. Poland has not implemented it yet. The European Accessibility Act ([Directive (EU) 2019/882](https://ordergroup.co/glossary/european-accessibility-act/)) has applied to consumer banking services, including consumer credit, since June 28, 2025, and in Poland the act of April 26, 2024 on accessibility requirements implements it. ### AI Act Under the AI Act (Regulation (EU) 2024/1689), AI systems used to assess the creditworthiness of natural persons are high-risk, except those used to detect financial fraud (Annex III, point 5(b)). See the glossary entry on the [AI Act](https://ordergroup.co/glossary/eu-ai-act/) for context. ## Security and consent in a lending app In AvaFin consent works in three layers: App Tracking Transparency on iOS, a consent platform that handles every SDK separately, and consents stored in the AvaFin system. Firebase Analytics, Crashlytics and AppsFlyer are switched off natively from the start and switched on once the app has read the user's decision. The startup of Crashlytics and Firebase Analytics is adjusted to the requirements of the client's legal team. Marketing consents are kept separately for e-mail, SMS, phone, the account area and push. A GDPR screen in the app covers access to data, rectification, restriction, objection, withdrawal of consent and deletion. Aasa24 manages marketing consents and cookies per channel too, and runs analytics only after consent. See the glossary entry on [consent management](https://ordergroup.co/glossary/consent-management/). In Aasa24 card data is encrypted and decrypted on the device in our own native module, and the PIN never appears as plain text. The card number and CVV show after the PIN is entered and disappear after a moment. Screens with sensitive data are masked in analytics and session recordings, and the app has been through external penetration tests. The AvaFin app puts a privacy screen over the content when it moves to the background and clears the chat when another customer signs in on the same device. Backend error messages reach the customer as translated texts, and keys and secrets are injected during the build. Continuous work for two KNF-supervised lenders ## Why lenders build with us Aasa24 gets a release every 3-4 weeks, and every pull request is reviewed. It has had continuous support since November 1, 2023. Code created for any client passes to the client with each payment. AvaFin work began on January 12, 2026. Where to start - [Free basic discovery workshop](https://ordergroup.co/services/consulting-discovery/product-workshops/) ![Why lenders build with us](https://ordergroup.co/media/images/aasa_maintenance_3HwjGwc.2e16d0ba.fill-2000x1200.format-webp.webp) ## How we work with a lender ### Rhythm of the work In Aasa24 planning happens once a month, at the start of the month. The product owner on Aasa's side assigns the tasks, and a daily call keeps the client in the loop. In AvaFin planning runs every two weeks, and the client shares a Slack channel with the team. Demos are regular and preceded by a trial demo. Design status meetings include the designer, the project manager and the tech leader, and QA holds its own sessions with the client. ### One source of truth for states In AvaFin the state matrix lists every possible state of the app with a technical ID, a name, the display logic and a UX/UI description. A blocker board with statuses, dates and comments shows what affects the deadline, and a large batch of designs is prepared ahead of development. It is the same idea as the 18 loan states described on our [loan management page](https://ordergroup.co/fintech-software-development/loan-management-software-development/), which describe the loan rather than the app. ### How a project starts It starts with a free consultation or a [discovery workshop](https://ordergroup.co/services/consulting-discovery/product-workshops/). The free basic discovery is one meeting. It gives a confirmed scope, an estimate and a basic mockup or proof of concept that lets us size the cost. The roadmap, the mockups or clickable prototype and the backlog come from extended discovery, a separate and broader scope. Let's start ## Ready to build or extend your lending product? Book a free basic discovery workshop and talk through your product with us. [Book a workshop](https://ordergroup.co/contact-us/) ## How to choose a fintech software development company Choosing a fintech app development company for a regulated lender comes down to seven questions. For each one, here is what a good answer looks like and where ours is on this page. - Which supervised lenders does it work for? A good answer names them. Ours: Aasa Polska and AvaFin Poland, both under KNF (lending software). - Who owns pricing and the credit decision? The lender's core system, with the app showing the result (what we build). - How does the application process change after launch? In the backend, without waiting for an app release (what we build). - How are consents and analytics SDKs handled? Analytics stays off until the user decides (security and consent). - What do releases and code review look like? Aasa24 gets a release every 3-4 weeks, and every pull request is reviewed (why lenders build with us). - Whose is the code? The client's, in writing, within the scope of rights set in the contract (why lenders build with us). - How does a project start? A first consultation and the basic discovery meeting are free, and after discovery we estimate the cost, timeline and team (how a project starts). Do you have questions? ## Questions about fintech software development ![Mateusz Widenka](https://ordergroup.co/media/images/T02DHCC1Z-U039G6G3JS1-8e7d2cd80ccb-512.format-webp.webp) Mateusz Widenka Head of Delivery [Book a free consultation](https://ordergroup.co/contact-us/) ### What kind of fintech software do you build? Custom fintech software development for lenders that run their own core system: mobile loan apps with their backend, admin panel and integrations. Beyond lending, we built [Monetor](https://ordergroup.co/case-studies/monetor-currency-risk-management-software/), a web app on the effect of exchange rates (Python, Django, Java, AWS), and redesigned BizBot, an Oslo startup automating company administration, with 400 screens, 21 landing pages and a design system. ### Which part of a lending product do you build, and which stays with the core system? We build what the borrower touches. The lender's core system keeps credit decisions, pricing, the loan book and collections, and Aasa24 handles an unavailable core system without losing the customer's data. See [loan origination software](https://ordergroup.co/fintech-software-development/loan-origination-software/) for the application flow and [loan management software development](https://ordergroup.co/fintech-software-development/loan-management-software-development/) for servicing. ### How does the app connect to our core system, payments, open banking and KYC? Through each provider's interface, behind a mapping layer in the app. Payment, verification and chat open in a secured WebView with an allowlist of domains and over HTTPS only, and the app refreshes the status when the customer returns. ### Can you add a payment card to our lending app? Yes, we did it for Aasa24 with a licensed issuer. The customer sets the PIN on the phone, adds the card to Google Pay and has daily and monthly limits. A positive bank account verification takes the card application straight to KYC, and the customer sees the result as soon as they continue. The glossary entry on [card issuing](https://ordergroup.co/glossary/card-issuing/) explains the model. ### What does CCD2 change in a lending app, and does our KYC flow need to change before the AMLR applies? Check the flows the customer sees first: advertising, the information form on a phone, consent screens, the path after an automated credit assessment and the arrears screens. For KYC, check whether you verify identity by a bank transfer or a bank login, because neither is on the AMLR list. CCD2 applies first, and the AMLR about eight months later. See our articles on [CCD2](https://ordergroup.co/blog/ccd2-lending-app-loan-application-flow/) and [AMLR and KYC](https://ordergroup.co/blog/amlr-kyc-lending-apps/). ### What technologies do fintech lending apps run on? React Native with TypeScript for both apps (Expo in AvaFin), Django with PostgreSQL on the Aasa24 backend and AWS managed with Terraform. AvaFin is split into 13 domain modules, and Aasa24 handles sensitive card data in a native module on the device. Our [React Native development](https://ordergroup.co/services/software-development/mobile-apps-development/) page covers the framework. ### How do you work with a lender, and what does the team look like? A team can include a project manager, a UX/UI designer, a QA tester and frontend and backend developers. We add each role only where your project needs it. In AvaFin the designer, the project manager and the tech leader join the design status meetings with the client. ### What affects the scope of a lending app, and how long does it take? The scope depends on the flows the borrower uses, the integrations with your core system, payments, open banking and KYC, and the platforms the app runs on. Across our custom software projects, a working MVP usually takes about 3 months and a full product 7 months or more. Basic discovery is free, and after the [discovery workshop](https://ordergroup.co/services/consulting-discovery/product-workshops/) we estimate the cost, timeline and team. ### How do we choose a fintech software development company? Ask a candidate to show how the application steps change after launch, and to point to the contract clause that gives you the code. Both are easy to check before you sign. ## Other fintech work An FX risk web app and a UX/UI redesign for an Oslo startup [Show all Case Studies](https://ordergroup.co/case-studies/) - [Monetor - A Web Application for Analysing Business FX Risk](https://ordergroup.co/case-studies/monetor-currency-risk-management-software/) The team is doing a tremendously good job and they are evolving with us throughout the process. ![Henric Jonsson](https://ordergroup.co/media/images/henric_jHDE923.2e16d0ba.fill-140x140.format-webp.webp) Henric Jonsson [Head of Business Development, Monetor](https://www.linkedin.com/in/henric-jonsson/) [![Monetor - A Web Application for Analysing Business FX Risk](https://ordergroup.co/media/images/Monetor_MpBAYWZ_CwCbCSJ.format-webp.width-1280.webp)](https://ordergroup.co/case-studies/monetor-currency-risk-management-software/) - [BizBot - There's No Successful App Without Solid UX](https://ordergroup.co/case-studies/bizbot-fintech-ux-design/) Order Group invests time to define the scope and ask clarifying questions. Their channels of communication lead to smooth remote project management. ![Didrik Martens](https://ordergroup.co/media/images/Didrik-Martens.2e16d0ba.fill-140x140.format-webp.webp) Didrik Martens [BizBot CEO](https://www.bizbot.com/) [![BizBot - There's No Successful App Without Solid UX](https://ordergroup.co/media/images/BizBot_NYrzFbs.format-webp.width-1280.webp)](https://ordergroup.co/case-studies/bizbot-fintech-ux-design/) ![Developer with headphones coding at desktop monitor in an open office](https://ordergroup.co/media/images/Image_1_3kejLC8_Y69T2Sz.format-webp.width-2880.webp) ## A fintech software house for regulated lenders, from the first version to maintenance. Your message goes to ![Filip Szamborski](https://ordergroup.co/media/images/Filip_dTWHyBo.2e16d0ba.fill-432x432.format-webp.webp) Filip Szamborski Co-founder & CEO [](https://www.linkedin.com/in/filip-szamborski/) SO FAR WE HAVE WORKED WITH BRANDS LIKE: - [![Skyfri](https://ordergroup.co/media/images/skyfri-mono_KGicBgp.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/skyfri-solar-asset-management-platform/) - ![Spacestor](https://ordergroup.co/media/images/spacestor-mono_woFaKhf.max-208x64.format-webp.webp) - [![Zeronest](https://ordergroup.co/media/images/zeronest-mono_BqSPQJQ_2nGxsSc.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/zeronest-solar-panel-monitoring-app/) - [![BizBot](https://ordergroup.co/media/images/bizbot-mono_StdJIUN.max-208x64.format-webp.webp)](https://ordergroup.co/case-studies/bizbot-fintech-ux-design/) - ![AASA24](https://ordergroup.co/media/images/aasa24-mono.max-208x64.format-webp.webp) Thank you for your message. We read every message ourselves and get back to you within 48 hrs on business days. Something urgent? [hello@ordergroup.co](mailto:hello@ordergroup.co)