Fintech app development in 2026: what to settle before you build

Fintech app development is ordinary product engineering plus six decisions that get expensive to change once customer money flows through the code. Decide who holds the licence for each regulated activity. Keep money in a double-entry, append-only ledger. Keep card numbers off your servers. Decide what to buy for KYC, AML and sanctions screening, and how long to keep each record. Make every control leave evidence an auditor can read. And choose where AI may make decisions and where it may only assist a person. Settle all six in the first block of the build, before the schema and vendor contracts set around them.

9io has kicked off products in healthcare, ecommerce, edtech and fintech. The detailed evidence here comes from our own market research platform, 9io Alpha, which we describe as engineering only.

The sections follow the order we’d use to work out how to build a fintech app, with US, UK, EU and Indian rules as of 18 October 2026. This isn’t legal advice, so check each point with a lawyer in every market you launch in.

Fintech app development starts with who holds the licence

Every regulated activity in a fintech product runs under someone’s licence, either yours or a partner’s. The licence holder sets how long launch takes, how much capital you need and which controls you build.

In the UK, the FCA’s new safeguarding rules for payment and e-money firms took effect on 7 May 2026. Its announcement noted average shortfalls of 65% of customer funds at payment firms that became insolvent between early 2018 and mid-2023.¹⁴ In the EU, PSD2 still applies, since the November 2025 deal on PSD3 and a Payment Services Regulation hadn’t been formally adopted by 20 September 2026.¹⁵

In India, the RBI requires payment system providers to store their payment data only in India, which fixes the cloud region before the first deploy.¹⁶ SEBI’s retail algo framework, applicable to all stock brokers from 1 April 2026, makes the broker the principal, bans open APIs and requires a whitelisted static IP and two-factor authentication.¹³¹⁷ Providers of algos whose logic users can’t see must register as research analysts.¹³

For a fintech MVP, a partner’s licence buys time to decide whether your own is worth the capital, and the partner will inspect your controls because it answers for you.

A double-entry ledger in integer minor units

The ledger is the part of fintech software development that is hardest to change later, because every balance, report and audit reads from it. Make it double-entry: each movement of money is one journal entry whose lines sum to zero in each currency. Make it append-only, and fix mistakes with reversing entries, so the history shows both the error and the fix.

Store amounts as integers in the currency’s minor unit, or as decimals. Python’s tutorial shows 0.1 + 0.1 + 0.1 == 0.3 evaluating to False in binary floating point and points accounting work to the decimal module.¹⁸ Stripe’s API takes 1000 to charge 10 USD but 10 to charge 10 JPY, and still represents ISK and UGX with two decimals for backward compatibility.¹⁹ Keep each currency’s minor-unit exponent in one table that every service reads.

Put an idempotency key on every call that moves money, and copy Stripe’s contract. Once the endpoint starts running, Stripe saves the status code and body of the first request made with a key and returns them on retries, 500 errors included. It rejects a retry whose parameters differ. Keys can be up to 255 characters and may be pruned once they are 24 hours old, so retries have to stop inside that window.²⁰ Here is a posting function with the same contract, for a generic Postgres client:

import hashlib
import json

# The database user that runs this has INSERT on both tables and no UPDATE or DELETE.
def post_entry(db, key: str, lines: list[tuple[str, int, str]]) -> int:
    """lines are (account, amount in minor units, currency); debits +, credits -."""
    if not all(type(amount) is int for _, amount, _ in lines):
        raise TypeError("amounts must be integers in minor units")
    for cur in {c for _, _, c in lines}:
        if sum(a for _, a, c in lines if c == cur) != 0:
            raise ValueError(f"entry does not balance in {cur}")
    digest = hashlib.sha256(json.dumps(sorted(lines)).encode()).hexdigest()
    with db.transaction():
        row = db.fetchone(
            "INSERT INTO entries (idem_key, request_hash) VALUES (%s, %s) "
            "ON CONFLICT (idem_key) DO NOTHING RETURNING id", (key, digest))
        if row is None:  # a retry: return the first result, refuse a different request
            first = db.fetchone(
                "SELECT id, request_hash FROM entries WHERE idem_key = %s", (key,))
            if first.request_hash != digest:
                raise ValueError("idempotency key reused with a different request")
            return first.id
        db.executemany(
            "INSERT INTO lines (entry_id, account, amount_minor, currency) "
            "VALUES (%s, %s, %s, %s)", [(row.id, *line) for line in lines])
        return row.id

Reconcile daily against processor and bank records. Stripe’s payout reconciliation report ties each bank payout to the transactions it settles, with amounts in major units where the API uses minor ones, and dates in UTC unless you ask for a time zone.²¹

Business days come from a calendar per rail and market. India’s RTGS has run 24x7x365 since 14 December 2020.²² NSE traded on Saturday 1 February 2025 for the Union Budget, though its circular notes a settlement holiday that day.²³ Store timestamps in UTC with the source’s time zone, and compute “today” in the time zone of the rule you’re applying.

PCI DSS 4.0.1 and how much card data you touch

PCI DSS v4.0.1 has been the only active version of the standard since v4.0 was retired on 31 December 2024.²⁴ Version 4.0 added 64 requirements, and the 51 that were future-dated took effect on 31 March 2025.²⁵

The cheapest route to compliance is keeping card numbers out of your systems. Stripe says a business that handles raw card data might have to meet more than 300 PCI DSS security controls, while the card type, last four digits and expiry date it returns aren’t subject to PCI compliance.²⁶ A processor’s hosted page or embedded form can keep you eligible for the SAQ A self-assessment questionnaire.

SAQ A changed in 2025. In January the PCI SSC removed from it requirements 6.4.3 and 11.6.1, which make sure payment-page scripts are authorised, checked for integrity and monitored for tampering, and the supporting risk analysis in 12.3.1. Instead, merchants confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems.²⁷²⁸ FAQ 1588 applies that criterion to pages that embed a processor’s payment form, such as an iframe, and excludes merchants that redirect or fully outsource payment. Embedding merchants can meet it with techniques like those in 6.4.3 and 11.6.1, or with confirmation from a PCI DSS compliant provider.²⁹ The requirements remain in PCI DSS itself.

So choose the checkout design early. A redirect takes the script question off your pages, while an embedded form makes the scripts running beside it, analytics and tag managers included, yours to control. Either way, keep card numbers out of logs and support tools.

KYC, AML and sanctions screening: what to buy and what to keep

Buy the parts of KYC and AML compliance that need data you can’t build, such as document and biometric verification, sanctions and politically exposed person lists, and adverse-media feeds. Own what an examiner will ask about. That means your risk rules, each customer’s case file, every screening hit and how it was cleared, and each vendor response stored with the list version it checked.

Retention periods differ by market, and they can conflict.

OFAC moved to 10 years to match a longer statute of limitations. Its final rule acknowledges potential tension with EU retention requirements, which a commenter said call for deleting some records after five years.³¹ The EU’s new AML Regulation applies from 10 July 2027.³⁴ So store retention as data, with each record’s jurisdiction, period and governing rule, and let a scheduled job delete or archive what has expired.

Security evidence: SOC 2, DORA and audit trails

A SOC 2 report is a CPA firm’s examination, under AICPA standards, of a service organisation’s controls relevant to security, availability, processing integrity, confidentiality or privacy.³⁵ A Type 2 report covers how those controls operated over a period,³⁶ so start in the first sprint with reviewed pull requests, access reviews, tested restores and alerts that page a person.

If you sell to EU financial firms, DORA shapes your contracts. It has applied since 17 January 2025 to about 20 types of financial entity, including credit institutions, payment and e-money institutions and investment firms.³⁷³⁸ They stay fully responsible for compliance when they use ICT services, register all their ICT third-party contracts, and need key contractual provisions in them.³⁹⁴⁰ On 18 November 2025 the European Supervisory Authorities also designated 19 critical ICT third-party providers for direct oversight, including the EU entities of Amazon Web Services, Google Cloud and Microsoft.⁴¹

Write the audit log like the ledger, append-only, recording who did what, when, from where and what changed. SEBI’s algo framework tags every algo order with an exchange-issued identifier to establish an audit trail.¹³ Separate the people who can move money from the people who can change who may, and keep the switch that enables live money out of the app’s reach.

AI in fintech: where models decide and where they assist

In the US, the Federal Reserve, the OCC and the FDIC issued revised model risk guidance on 17 April 2026, and the Fed’s SR 26-2 superseded SR 11-7. It is aimed mainly at banks with more than $30 billion in assets, sets no enforceable standards and keeps “effective challenge” by objective, independent experts. Deterministic rule-based processes don’t count as models under it, and generative and agentic AI models are left to each bank’s own risk management.⁴² Expect a bank partner to ask how you validate and monitor any statistical model you supply.

The CFPB withdrew Circulars 2022-03 and 2023-03 on 12 May 2025, among 67 guidance documents, and said the withdrawal was not necessarily final.⁴³ Its withdrawn-guidance page, last modified on 22 July 2026, still listed both.⁴⁴ The first had said complex algorithms don’t excuse a creditor from giving specific reasons for adverse action.⁴⁵ Regulation B still requires a statement of specific principal reasons, and calls a failure to reach a qualifying score on the creditor’s scoring system insufficient.⁴⁶ So a complex credit model needs reason codes, built and tested with the model.

In the EU, AI systems that evaluate the creditworthiness of individuals or set their credit score are high-risk under Annex III of the AI Act, unless they are used to detect financial fraud.⁴⁷ The digital omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026, moved the date the Annex III rules apply to 2 December 2027.⁴⁸⁴⁹ Deployers of these systems will also need a fundamental rights impact assessment before using them.⁵⁰ The chatbot rule didn’t move. Since 2 August 2026, an AI system that interacts with people must be designed so they know it’s an AI, unless that’s obvious.⁵¹

In India, SEBI makes research analysts and investment advisers who use AI tools solely responsible for the security of client data and for research or advice based on the tools’ output, and they must tell clients how far they use AI.⁵²⁵³

LLMs fit where a person or a deterministic check stands between the output and the customer’s money, as in support answers drawn from your own documentation, research summaries and reviewed document extraction. Keep them out of credit and trading decisions unless you can give specific reasons for each outcome and show how you validated the model.

What building 9io Alpha taught us about market and broker systems

9io Alpha is our own market research platform. It ingests daily prices for US and Indian stocks, runs an AI research pipeline, and has two broker API integrations, with Interactive Brokers (IBKR) and Zerodha’s Kite Connect. What follows is engineering only and isn’t investment advice.

Start where the code can’t trade. The IBKR path connects to the paper-trading port, the Kite path returns a dry run with the exact order and exit parameters, and live trading needs an explicit server setting that nothing in the app can change. IBKR’s own TWS ships with its API in read-only mode as a precaution.⁵⁴ Every order is validated and capped on our server before any broker call, as order safety by default describes.

Put the exit at the broker with the entry. On IBKR that’s a bracket whose transmit flags release the parent and both children together.⁵⁵ On Kite it’s a two-leg GTT in which one trigger cancels the other, and because Kite’s GTT API lists only limit orders, a triggered stop can fail to fill.⁵⁶ The buy and the GTT are separate calls, so a failed exit needs its own warning on screen. Treat a cancel as pending until the broker confirms it, since IBKR doesn’t guarantee a status callback for every change.⁵⁷

In the SEC’s Knight Capital case, the firm’s router sent more than 4 million orders in the first 45 minutes after the open on 1 August 2012 while trying to fill 212 customer orders, and Knight lost more than $460 million.⁵⁸

Expect data sources to fail quietly. Yahoo, reached through the open-source yfinance library, often signals throttling with an empty or all-NaN result instead of an error. We treat those as throttled, send 100 symbols per chunk with 7-second pauses, and back off from 45 seconds to a 300-second cap. A missing NSE end-of-day file can mean a holiday or a late upload, so we record a holiday only when both file formats return 404 for a date at least two days old. Broker sessions keep their own clocks, and a Kite access token expires at 6 am the next day.⁵⁹ The market data post has the details.

Show what a backtest can and can’t see. Our backtester gives each simulated day only the rows up to that day, and a daily bar that touches both the stop and the target counts as a stop. We publish its limits in the look-ahead bias post. Trades enter at the close that produced the signal, the stock list uses today’s index members and end-of-test liquidity, no costs are charged, and the rules were written during part of the test period.

Check every model answer in code. Our research pipeline sends two differently prompted reviews of the same evidence, plus a rules-based vote, to a judge model. Code then checks that the verdict is an allowed value, that numbers are in range and that a thesis exists, and caps confidence at 60 when the reviews disagree. If the judge fails, fixed rules decide. Both reviews run on one model, so we treat their agreement as weaker evidence than agreement between different models.

A fintech kickoff and compliance checklist

We’d want each of these settled by the end of the first block of a product build, while the architecture is still cheap to change.

• Name the licence holder for each regulated activity in each launch market, decide where customer and payment data may be stored, and have a lawyer check both.
• Build a double-entry, append-only ledger in integer minor units, with an idempotency key on every call that moves money.
• Reconcile daily against processor and bank records, with UTC timestamps and a business-day calendar per rail and market.
• Choose a redirect or an embedded payment form, and confirm which SAQ applies, before checkout is designed.
• Buy identity checks and screening data, and own the case files, list versions and retention schedule per jurisdiction.
• Keep append-only audit logs, collect SOC 2 evidence from the first sprint, and expect DORA contract terms if you’ll sell to EU financial firms.
• For each AI feature, record whether it decides or assists, which rule applies, and how a customer gets specific reasons.
• Start anything that can move money or place orders in a mode that can’t, and validate and cap each request on your server first.

Frequently asked questions