Fintech software development for regulated lenders

At a lender with its own core system, the borrower meets the app, not the core system. The core system sets the prices (including the APR), decides on credit, keeps the loan book and runs collections and the contact strategy, and an external provider verifies identity. We are a fintech software house for regulated lenders, and we build the app side for Aasa Polska (since May 2023) and AvaFin Poland, both loan institutions under KNF. The product view of this work is on our loan origination software and loan management software development pages.

What the app side includes

• The app for iOS and Android in React Native, with the loan calculator, the application flow, the account area and the card, developed continuously.
• The backend of the app and an admin panel where Aasa's team changes calculator parameters, documents and messages without a release in the app stores.
• Integrations with the core system, open banking account checks, the KYC provider and the card issuer.
• Consent handling, analytics and the protection of sensitive data.

Several EU and Polish requirements shape how a lending app has to behave between 2025 and 2027. We build the software side: each requirement ends up in a screen, a consent or a verification step. The legal reading of these rules, and the compliance of the lender's process with them, stays with the lender's lawyer.

CCD2, from November 20, 2026

National rules implementing CCD2, the new Consumer Credit Directive (Directive (EU) 2023/2225), apply from November 20, 2026 (Article 48). As of October 2026 Poland has not published an implementing act, and on May 27, 2026 the government withdrew the draft consumer credit act (UC82) from the work of the European Affairs Committee. The requirements that show up in software:

• Every piece of advertising carries the cost warning (Article 8). The information form must stay legible within the limits of the medium (Article 10(6)), which we read as legibility on a phone screen.
• Pre-ticked boxes do not count as consent (Article 15). An add-on cannot be a condition of getting the loan (Article 14), and a loan is not granted without the customer's request (Article 17).
• The lender documents the credit assessment, and after an automated assessment the consumer can ask for human intervention (Article 18).
• In arrears, the lender applies reasonable forbearance before enforcement, detects customers in financial difficulty early and refers them to debt advice (Articles 35 and 36).

Our article on CCD2 in the loan application flow goes through these requirements step by step.

AMLR, from July 10, 2027: what a KYC integration has to absorb

The Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) names two routes for identity verification in Article 22(6): an identity document, or an electronic ID at a substantial or high assurance level, together with qualified trust services. A verification transfer or a bank login confirms a bank account, and neither is on that list. A KYC integration that can absorb the change keeps verification methods in backend configuration, records every attempt and keeps the documentation for five years. Waiting, rejected and manual-review cases each get their own status, and the retry rules are easy to change. Our article on AMLR and KYC in lending apps covers the change in detail.

Consumer credit law and supervision today

Loan institutions in Poland have been under KNF supervision since January 1, 2024, under the anti-usury act, and the number of active institutions has fallen from about 500 to about 100, according to PAP. Until a new act arrives, the act of May 12, 2011 on consumer credit applies: creditworthiness assessment before the agreement (Article 9), a check of the PESEL restriction register before every agreement and every change that increases debt (Article 9b) and the information form on a durable medium (Articles 13 and 14).

Distance financial services and accessibility

Directive (EU) 2023/2673 on financial services concluded at a distance applies from June 19, 2026 and brings a right-of-withdrawal function for agreements concluded through an online interface. Poland has not implemented it yet. The European Accessibility Act (Directive (EU) 2019/882) has applied to consumer banking services, including consumer credit, since June 28, 2025, and in Poland the act of April 26, 2024 on accessibility requirements implements it.

AI Act

Under the AI Act (Regulation (EU) 2024/1689), AI systems used to assess the creditworthiness of natural persons are high-risk, except those used to detect financial fraud (Annex III, point 5(b)). See the glossary entry on the AI Act for context.

In AvaFin consent works in three layers: App Tracking Transparency on iOS, a consent platform that handles every SDK separately, and consents stored in the AvaFin system. Firebase Analytics, Crashlytics and AppsFlyer are switched off natively from the start and switched on once the app has read the user's decision. The startup of Crashlytics and Firebase Analytics is adjusted to the requirements of the client's legal team.

Marketing consents are kept separately for e-mail, SMS, phone, the account area and push. A GDPR screen in the app covers access to data, rectification, restriction, objection, withdrawal of consent and deletion. Aasa24 manages marketing consents and cookies per channel too, and runs analytics only after consent. See the glossary entry on consent management.

In Aasa24 card data is encrypted and decrypted on the device in our own native module, and the PIN never appears as plain text. The card number and CVV show after the PIN is entered and disappear after a moment. Screens with sensitive data are masked in analytics and session recordings, and the app has been through external penetration tests.

The AvaFin app puts a privacy screen over the content when it moves to the background and clears the chat when another customer signs in on the same device. Backend error messages reach the customer as translated texts, and keys and secrets are injected during the build.

Rhythm of the work

In Aasa24 planning happens once a month, at the start of the month. The product owner on Aasa's side assigns the tasks, and a daily call keeps the client in the loop. In AvaFin planning runs every two weeks, and the client shares a Slack channel with the team. Demos are regular and preceded by a trial demo. Design status meetings include the designer, the project manager and the tech leader, and QA holds its own sessions with the client.

One source of truth for states

In AvaFin the state matrix lists every possible state of the app with a technical ID, a name, the display logic and a UX/UI description. A blocker board with statuses, dates and comments shows what affects the deadline, and a large batch of designs is prepared ahead of development. It is the same idea as the 18 loan states described on our loan management page, which describe the loan rather than the app.

How a project starts

It starts with a free consultation or a discovery workshop. The free basic discovery is one meeting. It gives a confirmed scope, an estimate and a basic mockup or proof of concept that lets us size the cost. The roadmap, the mockups or clickable prototype and the backlog come from extended discovery, a separate and broader scope.

Choosing a fintech app development company for a regulated lender comes down to seven questions. For each one, here is what a good answer looks like and where ours is on this page.

• Which supervised lenders does it work for? A good answer names them. Ours: Aasa Polska and AvaFin Poland, both under KNF (lending software).
• Who owns pricing and the credit decision? The lender's core system, with the app showing the result (what we build).
• How does the application process change after launch? In the backend, without waiting for an app release (what we build).
• How are consents and analytics SDKs handled? Analytics stays off until the user decides (security and consent).
• What do releases and code review look like? Aasa24 gets a release every 3-4 weeks, and every pull request is reviewed (why lenders build with us).
• Whose is the code? The client's, in writing, within the scope of rights set in the contract (why lenders build with us).
• How does a project start? A first consultation and the basic discovery meeting are free, and after discovery we estimate the cost, timeline and team (how a project starts).