Loan origination software development

Lending software has three layers: a loan origination system (LOS), a loan management system (LMS) and the customer app or portal that talks to both. The LOS takes a loan from application to payout: the application, verification of the applicant's data, the decision, the offer, the agreement and the payout. The LMS services the loan afterwards. Many vendors sell the LOS and LMS as one product. Loan origination software development, as we do it, means building the application part of the customer layer and connecting it to the lender's core system. Servicing after payout is covered on our loan management software development page, and the wider field on our lending software development page.

Since May 2023 we have built and developed Aasa24, the lending app of Aasa Polska. Since January 2026 we have been building the mobile app of AvaFin Poland. Both are loan institutions supervised by KNF.

Our side: the customer channel

• The mobile app for iOS and Android in React Native, with the loan calculator and the application flow.
• The backend of the app and an admin panel.
• Integrations with your core system, payment providers, open banking, the KYC (know your customer) provider and the card issuer.

Your side: the core system

• Credit decisions.
• The pricing engine, including the APR calculation.
• The loan book.

The identity verification service is run by an external provider, which we integrate.

The Aasa24 backend is ours: Django, PostgreSQL and Celery on AWS, with infrastructure in Terraform. It takes loan data, statuses and calculator parameters from Aasa's core system through an API.

A loan application is a chain of steps, and several of them depend on outside services: identity verification, bank account verification, credit bureaus and the PESEL restriction register. Any of them can fail to answer or return a result that needs a person to decide. For that reason we build the application as a set of explicit states that the customer can see.

Aasa24 has 13 application steps, with open banking and contract signing by SMS, and more than 40 application and loan states turned into plain messages. While the decision is pending, the AvaFin app shows a screen saying the application is being analyzed.

KYC, bank account verification and the PESEL check are three separate steps of the loan application, each with its own status.

Bank account verification

AvaFin customers verify a bank account by logging in to their bank through open banking or with a verification transfer. The check runs at registration and in the loan application.

PESEL and multi-level verification

In Aasa24 the PESEL restriction check, a flag Poles can set on their national ID number against identity theft, is a step of the application with its own status. Verification works on several levels: KYC with a document scan, PESEL with an SMS code, and repeat or manual verification in difficult cases. A customer can retry after a negative result.

In Aasa24 the application for a payment card with a renewable limit has its own KYC status. A positive bank account verification moves it on to KYC, and a customer whose application was rejected after three failed attempts can go through KYC on a new application.

In the AvaFin app the core system decides the order of the loan application steps, and the app displays them. Changing the order or the scope of the steps does not need a new app version.

The AvaFin calculator shows guests and logged-in customers the amount, period, cost, APR, repayment date and promo codes. Prices come from the same pricing engine as the core system, so the amount in the app is the amount in the agreement.

Aasa's team changes calculator parameters, documents and messages in the Aasa24 admin panel, without a release in the app stores.

If you are choosing loan origination system software, a ready-made LOS gives you the decision, the rules and the bookkeeping from the vendor. An origination channel of your own on top of your core system gives you your own application flow, your own screens and changes without waiting for a vendor. Which one fits depends on the lender, and a free discovery workshop is where we work that out with you.

What the decision system has to do, whoever supplies it

These requirements hold for a decision system whether you buy it or build it.

• Every decision is recorded with its data and the versions of the rules it used, and the rules are versioned.
• A person can review a decision.
• Fraud checks are a separate module.
• Cheaper checks run before paid queries to credit bureaus.
• One pricing engine serves all channels.

CCD2, the Consumer Credit Directive 2 (Directive (EU) 2023/2225), applies through national rules from November 20, 2026. As of October 2026, Poland has not published a new act implementing it. In a loan application these provisions end up on screens, in consents and in the decision flow.

What CCD2 changes in the loan application

• Every advertisement, including a calculator, carries the cost warning (Article 8).
• The information form must be consistent and legible within the limits of the medium (Article 10(6)). In an app we read that as legibility on a phone; the article itself does not mention phones.
• Tying is prohibited (Article 14).
• Pre-ticked boxes are not consent (Article 15).
• An offer the customer did not ask for waits for their agreement (Article 17).
• The lender documents the creditworthiness assessment, and after an automated assessment the consumer can ask for human intervention (Article 18). In an app that means a request path and a review queue.

The Consumer Credit Act in Poland

The assessment comes before the agreement (Article 9). A loan institution may grant credit only after a positive assessment (Article 9a). The PESEL restriction register is checked before every agreement and every amendment that increases the debt (Article 9b). The information form goes to the consumer on a durable medium (Articles 13 and 14).

AMLR and the AI Act

From July 10, 2027, Article 22(6) of the AMLR, the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), names an identity document or electronic identification with qualified trust services for identity verification. A verification transfer and a bank login are not on that list.

Under the AI Act, AI systems that evaluate the creditworthiness of natural persons are high-risk, except AI systems used to detect financial fraud (Annex III, point 5(b)).

We do not describe the apps we build as CCD2-compliant. The legal reading stays with your lawyer. Our article on CCD2 in lending apps goes through the application flow in more detail.

Aasa24 masks screens with sensitive data in analytics and session recordings. The PIN never appears as plain text, and the app has been through external penetration tests. Analytics starts only after the customer's consent.

In the AvaFin app, analytics and crash reporting wait for the customer's decision, which the app reads from the consent management platform.