Fintech and payments
Fintech Software Development
Financial software fails in two directions: it breaks a ledger, or it breaks a rule. We build the systems that sit between those failures, from double-entry transaction cores and SCA-compliant checkout to KYC onboarding and the audit trails a supervisor actually asks for. Our own products are the evidence the engineering holds: Arhivix runs AES-256 encrypted document storage for 500+ companies under EU archiving rules, and 50+ shipped client projects sit behind it.
The problem
Where fintech teams get stuck.
The register nobody can produce
DORA turns every ICT contract into a row in a structured register: legal entity identifiers, function codes, criticality flags, data locations, subcontracting terms. Most teams keep it as a spreadsheet that one person refreshes before an audit, so the flags stop matching reality within a quarter.
The fix is a data model rather than a document. Procurement, IAM, and the service catalog feed one record per contract, and the register is generated on demand instead of reconstructed under deadline.
A reporting clock that starts before you notice
A major ICT incident triggers an initial notification within hours, an intermediate update, and a final report. The trap is classification: if an alert sits in second-line triage before anyone asks whether it is reportable, the clock has already run down. Most SOC playbooks were written without a regulatory classification step at the alert level.
Our DORA deep dive breaks down the 4-hour, 72-hour, and one-month notifications and what it takes to make the first one reachable.
SCA that costs you the checkout
Strong Customer Authentication protects the payment and punishes the funnel when it ships as a blanket challenge. Exemption logic, the quality of the risk data you send into 3D Secure 2, and dynamic linking of the code to amount and payee decide whether a European checkout converts.
The same build usually exposes a second leak: recurring payments that fail on expired cards and thin balances with no dunning sequence behind them, so paying customers churn involuntarily. Both are covered in our billing and payments guide.
Ledgers that quietly drift
Balances stored as a column and updated in place. Floating-point arithmetic on money. A retry that creates a second transfer because the endpoint was never idempotent. None of these fail loudly. They surface weeks later as a reconciliation break, after real customer money has moved through the defect.
A financial core wants immutable entries, explicit decimal or integer precision, balances derived from entries, idempotency keys on every write, and a daily reconciliation job against the processor that alerts instead of drifting.
What we build
How we solve it.
Compliance
The rules that shape the build.
DORA: ICT risk and third-party resilience
Regulation (EU) 2022/2554 has been in application since 17 January 2025 and covers around 20 categories of financial entity plus their ICT providers. Its five pillars are ICT risk management, incident reporting, resilience testing including threat-led penetration testing, third-party risk with mandatory contractual provisions, and the register of information.
The register is a structured dataset, not a vendor list. The EBA published the implementing technical standards with the templates, and the same data feeds designation of critical ICT third-party providers under the EU oversight framework. If procurement, IAM, and your service catalog are not wired into it, producing the register takes weeks instead of hours, and the exit plans for your top concentrations stay theoretical.
PSD2, strong customer authentication, and the PSD3 rewrite
Strong Customer Authentication has been enforceable in the EEA since 13 September 2019 under Directive (EU) 2015/2366. In build terms that means 3D Secure 2 on card-not-present flows, dynamic linking of the authentication code to the amount and payee, FAPI-grade OAuth with mutual TLS on open banking interfaces, and consent that the customer can revoke.
The rewrite is under way: the European Parliament and Council reached political agreement on PSD3 and the Payment Services Regulation on 27 November 2025, per the same Commission page. Nothing in the current rules lapses before those texts apply, so the correct move today is an authentication and consent layer with the exemption logic externalized, not hardcoded into checkout.
KYC, AML, and the license you are building under
Embedded finance does not move the AML obligation off your platform. The EU recast the rulebook in 2024 with Regulation (EU) 2024/1624, Directive (EU) 2024/1640, and the AMLA Regulation (EU) 2024/1620, creating a new Anti-Money Laundering Authority seated in Frankfurt, with the substantive rules taking effect from 2027. Tiered KYC, business verification with beneficial ownership, sanctions screening at onboarding and on a schedule, and an immutable audit trail are all engineering work with a deadline attached.
The other half is licensing. Running under a partner e-money or payment institution license, a BaaS provider, or your own authorization changes what the software must enforce: transaction limits, fund segregation, consent capture, and who signs off a suspicious activity report.
PCI DSS v4.x and payment page integrity
The 51 future-dated requirements in PCI DSS v4.x stopped being best practice and became mandatory after 31 March 2025. Two of them, 6.4.3 and 11.6.1, target e-skimming: every script on a payment page has to be authorized, integrity checked, and monitored for tampering.
That reshapes checkout architecture. Tokenized, processor-hosted card fields keep you in SAQ A or SAQ A-EP scope instead of the several hundred requirements behind SAQ D, and a tag manager quietly injecting third-party scripts into a payment page is now an assessment finding rather than a growth tactic.
Proof
Products we have shipped.
None of these are fintech clients, and we are not going to imply otherwise. This is the adjacent work the page rests on: encrypted storage under EU archiving rules, a secure checkout and payment flow we built and still run, and AI shipped against an enterprise security bar with SSO and an admin console.
Related reading
FAQ
Common questions.
Let's talk
Bring us the part of the build that worries you.
Free 30-minute consultation. Come with the ledger design, the DORA gap list, or the payments integration that keeps breaking, and you will leave with an honest read on scope, sequence, and whether we are the right team. We reply within 24 hours, and if the work belongs with a licensed provider instead of a build team, we will tell you that too.
Book a Free Consultation