5 Checks to Run First

Within the fintech failures described by regulators just lately, the difficulty is just not in regards to the app screens. IT is about dealing with cash within the product – the mismatched balances, misguided funds, and ineffective checks on prospects. These are simpler and cheaper to unravel earlier than the product launch than when precise prospects are utilizing the product.

That is why some groups choose to contemplate them design points somewhat than testing ones. Nomium, a tech firm that gives software development services for fintech products (fee methods, digital banking and lending apps), normally begins the method with a discovery stage. Earlier than coding begins, the staff agrees with the consumer on which actions produce a monetary file, what system shops every specific piece of Information, and what occurs if there may be an error in IT.

Listed below are 5 checks that use the identical logic and will be utilized by any staff (in-house or exterior). They cut back the chance of a nasty launch, however they don’t change recommendation from attorneys and compliance specialists as a result of the laws differs from nation to nation and from product kind to product kind.

1. Do your balances match the financial institution?

Each buyer’s stability within the product should correspond to the precise amount of cash at your financial institution or companion financial institution. In any other case, IT turns into inconceivable to know who’s owed what.

A transparent instance is the US firm Synapse, which linked banks and fintech apps. Based on the US deposit insurer, the FDIC, after Synapse declared chapter, many purchasers couldn’t attain their cash for months. Even for the banks, IT grew to become arduous to match the data of Synapse with precise balances.

Within the UK, this type of matching is now necessary. Ranging from Might 2026, FCA rules obligate fee and e-money corporations to confirm buyer cash towards their very own data each working day.

What to examine: your system creates every stability utilizing the entire historical past of the transactions, not a single worth that overwrites the earlier ones. A each day report compares the balances within the system with these within the financial institution, and a named individual is chargeable for fixing all of the variations.

2. What occurs when a fee goes incorrect?

Actual-life funds will not be good. A request can day out and be despatched once more, so the client could pay twice. A notification a few profitable fee could come delayed, in duplicate or within the incorrect order.

IT is overtly acknowledged by fee suppliers. For instance, Stripe notes in its documentation that the identical notification could come a number of instances and the order of occasions can’t be assured. Stripe additionally provides a particular request ID that stops a repeated request from being processed twice.

A fee that appears profitable might also be returned. Based on the rules of Nacha, an organisation that establishes US ACH (Automated Clearing Home) financial institution switch guidelines, a buyer’s financial institution could return an unauthorised debit from the client’s account inside 60 days. In case your product pays out the cash instantly after receiving the “success” standing, you might lose that cash later.

What to examine: each fee has clear statuses, comparable to pending, accomplished, failed and returned. The staff is aware of what the client and assist employees see in every case after testing repeated, delayed and out-of-order notifications.

3. Do your buyer checks actually work?

Having a written coverage for buyer checks doesn’t imply having checks that work. This contains id checks (normally referred to as KYC), anti-money laundering checks and sanctions screening.

The UK regulator, the FCA, fined two digital banks for that reason. Starling Financial institution was fined about £29 million in 2024 as a result of for years its automated system had been checking prospects solely towards a part of the sanctions record. Monzo was fined about £21 million in 2025, partly as a result of IT accepted prospects with clearly unrealistic information, like well-known London landmarks within the residence deal with discipline.

In each instances, the regulator famous that checks weren’t in a position to sustain with quick buyer development. That is the actual threat of a brand new product: what works for 1,000 customers doesn’t essentially work for 1,000,000 customers.

What to examine: earlier than the launch, run faux “dangerous” check prospects via the actual sign-up circulation. For instance, use a reputation that matches a sanctions record, an inconceivable deal with and strange cash transfers. Every of them ought to increase an alert that reaches an individual in a position to take motion. Estimate the variety of alerts you’ll obtain as you develop and ensure the precise guidelines on your market together with your compliance specialist.

4. What if a key companion stops cooperating with you?

Fintech merchandise rely upon their companions: a financial institution, a banking-as-a-service supplier, a card processor, or an id examine service. The failure of the companion or its determination to finish the contract could make your product inoperable, even when there are not any errors in your code.

The US banking regulators (the OCC, the Federal Reserve and the FDIC) pointed this out of their joint assertion in July 2024. Among the many dangers they highlighted had been operational issues, extreme reliance on one companion, confusion amongst prospects and deceptive Information about deposit insurance coverage. The Synapse case confirmed the principle level: the failure of the one firm that retains data of whose cash belongs to whom can freeze everybody else.

What to examine: you’ll be able to present solutions to 3 questions in writing.

• Who retains the principle file of every buyer’s stability?
• Do you retain your individual up-to-date copy of IT?
• What’s the plan if the important thing companion fails, and does your contract grant you entry to the information?

Additionally ensure that the Information you give to prospects about deposit safety corresponds to your precise authorized preparations, to not the advertising textual content of the companion.

5. Can one buyer see one other buyer’s account?

A standard safety drawback in monetary purposes is unexpectedly easy. A consumer opens their account, replaces the account quantity within the request, and the system shows one other buyer’s account. IT occurs as a result of the system verifies the consumer’s login however doesn’t confirm that the account belongs to this consumer.

OWASP, a well known safety group, places this drawback on the prime of its 2023 record of the highest ten API safety dangers. The identical record mentions the dangers of letting an bizarre consumer attain administrative features like refunds or guide stability corrections.

What to examine: create two check prospects. Logged in because the second buyer, attempt to open and alter accounts and transfers of the primary buyer via the API, not via the app screens. Each try should fail. On your personal employees, grant every function solely the required entry and require the approval of one other individual for guide cash transactions.

Easy pre-launch guidelines

Earlier than you approve the launch date, ask the staff to exhibit the completion of every examine. If one thing remains to be lacking, that is the difficulty to debate.

Test	What can go incorrect	What to ask for
Balances	Your numbers don’t match the financial institution	Day by day matching report and an individual chargeable for variations
Funds	Double fees or cash paid out too early	Record of fee statuses and exams of repeated or late messages
Buyer checks	Unhealthy actors get via as you develop	Outcomes of exams of faux “dangerous” prospects and an alert assessment plan
Companions	The product stops if a companion fails	Your individual copy of stability data, a backup plan and contract phrases on information
Entry	One buyer sees one other buyer’s cash	Check outcomes with two accounts and an inventory of employees entry rights

What can wait and what can not

A minimal viable product doesn’t essentially have all options, all markets or a handsome admin panel. All these will be added later, whenever you already know the way your customers work together with the product. Nomium defines a fintech MVP in an identical means – a launch that exams one specific workflow with a sure target market whereas maintaining the required controls.

Stability data, fee statuses, buyer checks and entry management are completely different. They affect each transaction from the primary buyer, so fixing them later requires fixing the previous information, not including a function. There’s a easy rule right here: set the date of the launch when the guidelines is prepared, not when the function record is.