Business Requirements Document (BRD): Drop — Fintech Payment App

Project: Drop — Remittance + QR Payments Version: 1.0 Date: 2026-02-08 (updated 2026-02-23) Author: John (AI Director) + product agent + finance agent + legal agent Status: Approved Reviewers: Alem Bašić (CEO)

Document History

Version	Date	Author	Changes
0.1	2026-02-08	product + finance + legal agents	Initial 2-round analysis
1.0	2026-02-23	John	Formalised with current state; updated for pass-through model

1. Executive Summary

Project Overview: Drop is a PSD2 pass-through fintech payment app for all residents in Norway/Scandinavia, built by ALAI Holding AS (org.nr 932 516 136). It offers two core services: international remittance at 0.5% fee and QR-based merchant payments at 1% fee, both executed via Open Banking (AISP/PISP) directly from users' Norwegian bank accounts — Drop never holds customer money.

Business Problem: Residents of Norway are systematically overcharged for international money transfers (5-10% fees) and local merchants pay excessive payment processing fees to Vipps (1.75-2.75%), with no single app combining both needs affordably.

Proposed Solution: A BankID-native mobile payment app leveraging PSD2 Open Banking to initiate payments directly from users' bank accounts — eliminating the need for wallets, top-ups, or money holding — at fees 10-20x lower than existing remittance providers.

Expected Outcomes:

3,000 users and 200 merchants by Month 12 post-launch
130,000 NOK Monthly Recurring Revenue by Month 12
ALAI Holding AS generates sustainable product revenue independent of consulting
Drop becomes the default remittance + QR payment tool in Norwegian immigrant communities

Investment: ~250,000 NOK | Timeline: ~20 weeks (Phases 0.5–3) | Priority: High

2. Business Objectives & Goals

ID	Objective	Description	Target	Timeframe
BO-01	Generate product revenue	Establish recurring transaction fee revenue for ALAI	130,000 NOK MRR	Month 12 post-launch
BO-02	Capture remittance market share	Become preferred app for Norwegian residents sending money abroad	3,000 active users	Month 12 post-launch
BO-03	Onboard local merchants	Establish QR payment network with local businesses	200 merchants	Month 12 post-launch
BO-04	Demonstrate AI-native product development	Drop proves ALAI can build fintech products at 10K NOK dev cost	MVP shipped in < 8 weeks	2026-04-01
BO-05	Secure regulatory compliance	Obtain PISP/AISP registration with Finanstilsynet	Registration submitted	2026-05-15

Alignment to Strategic Goals:

ALAI product revenue: Drop is ALAI's first internal SaaS product, reducing dependence on consulting revenue
Innovasjon Norge grant: Drop is the flagship product for the 150K NOK Oppstartstilskudd application

3. Current State Analysis (AS-IS)

3.1 Current Process Overview

Norwegian residents who need to send money internationally currently use Western Union, MoneyGram, or Wise. Each requires account setup, separate registration, and charges significantly higher fees. For local payments, Vipps dominates — but charges merchants 1.75-2.75% per transaction. No single app serves both needs.

3.2 AS-IS Process Flow (Remittance)

flowchart LR
    A([User needs to send money abroad]) --> B[Open Western Union / Wise app]
    B --> C[Register / log in]
    C --> D[Enter recipient details + bank account]
    D --> E[Enter amount]
    E --> F{Fee check — 5-10%}
    F -->|Accept| G[Pay with card / bank transfer]
    F -->|Too expensive| H[Try alternative — multiple apps]
    G --> I[Money transfers in 1-3 business days]
    H --> B
    I --> J([Recipient receives funds])

3.3 Current Systems & Tools

System / Tool	Purpose	Users	Limitations
Western Union	International remittance	~500K Norwegians	5-10% fees; outdated UX; physical location required
Wise	International transfers	Tech-savvy immigrants	0.7-1.5% fees; no QR payments; not community-focused
Vipps	Local payments	5M+ Norwegians	No remittance; 1.75-2.75% merchant fees; no international
Revolut	Multi-currency	Young professionals	Complex; no QR; not trusted by older communities
MoneyGram	Remittance	Diaspora	4-8% fees; physical agents; poor UX
Manual (cash / hawala)	Informal remittance	Undocumented users	Unregulated; no tracking; risk

3.4 Current State Pain Points

#	Pain Point	Category	Affected Users	Business Impact	Severity
PP-01	Remittance fees of 5-10% (vs technically possible < 1%)	Financial	~500K immigrants in Norway	~285M NOK/year overcharged on 5.7B NOK market	High
PP-02	Vipps merchant fees 1.75-2.75% cut into margins	Financial	~195K Norwegian SMEs	Kebab shop at 50K NOK/month pays up to 1,375 NOK in fees	High
PP-03	Multiple apps needed — remittance app + payment app	UX	All users	Friction; low adoption; no flywheel	Medium
PP-04	Existing apps require top-up / wallet — not trusted	Trust	Immigrant communities	Lower conversion; money movement risk	High
PP-05	No app designed for Norwegian immigrant community trust	Cultural	~1M immigrants	Generic apps have low cultural fit; word-of-mouth weak	Medium

3.5 Current State Metrics (Baseline)

Metric	Current Value	Source	Notes
Average remittance fee from Norway	5-10%	World Bank 2025	WU/MoneyGram dominant
Remittance market size (Norway)	5.7B NOK/year	World Bank	Total outbound
Vipps merchant fee	1.75-2.75%	Vipps pricing 2026	Per transaction
Wise fee (NOK corridor)	0.7-1.5%	Wise website 2026	Cheapest legal alternative
Drop target fee (remittance)	0.5%	Internal model	PSD2 pass-through enables
Drop target fee (QR)	1%	Internal model	vs Vipps 1.75-2.75%

4. Future State Vision (TO-BE)

4.1 Future State Description

A resident of Norway opens Drop, verifies via BankID once, links their Norwegian bank account, and can immediately send money to Serbia, Pakistan, or Poland at 0.5% — directly from their bank account. No top-up, no wallet, no holding period. The recipient gets cash or bank transfer within 1-2 business days. Later, the same user walks into a local kebab shop, scans the Drop QR code at the counter, and pays 129 NOK — faster than tapping a card, with the shop paying just 1.29 NOK in fees.

4.2 TO-BE Process Flow (Remittance)

flowchart LR
    A([User opens Drop]) --> B[BankID verification — once]
    B --> C[Select: Send Money]
    C --> D[Choose country + recipient]
    D --> E[Enter amount — see fee 0.5%]
    E --> F[Confirm — PISP initiates from bank]
    F --> G[Drop backend processes via BaaS]
    G --> H[Recipient bank/cash pickup]
    H --> I([Recipient receives in 1-2 days])

4.3 Key Improvements

Area	AS-IS	TO-BE	Improvement
Remittance fee	5-10%	0.5%	10-20x cheaper
QR merchant fee	1.75-2.75% (Vipps)	1%	43-63% cheaper
Apps needed	2+ (remittance + payment)	1 (Drop)	Single app flywheel
Money held by app	Yes (wallet top-up)	No (bank stays in bank)	Better user trust
BankID integration	No (separate app)	Yes (native SCA)	Norwegian-native UX
Onboarding time	15-20 minutes	< 3 minutes	80%+ faster

5. Market Analysis & Competitive Landscape

5.1 Market Context

Norway has ~1,000,000 immigrants (SSB 2025) who send 5.7 billion NOK abroad annually via remittance. Additionally, ~195,000 SMEs in Norway accept payments — predominantly via Vipps. The PSD2 Open Banking regulation enables new entrants to initiate payments directly from customer bank accounts (PISP) and read account data (AISP) without holding funds — enabling Drop's pass-through model.

5.2 Competitive Analysis

Competitor	Solution Type	Key Features	Pricing	Our Advantage
Western Union	Direct (remittance)	Global reach; cash pickup; brand recognition	5-10% fee	10-20x cheaper; better UX; digital-only
Wise	Direct (remittance)	0.7-1.5% fee; multi-currency	0.7-1.5%	Cheaper (0.5%); QR payments combo; community trust
Vipps	Direct (QR/local)	5M users; ubiquitous in Norway	1.75-2.75% merchant	Remittance combo; 43-63% cheaper merchant fee
Revolut	Indirect	Multi-feature; international	0.5-1.5%	Simpler; Norwegian-native; QR payments
MoneyGram	Direct (remittance)	Global cash network	4-8%	8-16x cheaper; mobile-native

5.3 Positioning

Unique Value Proposition: Drop is the only app in Norway combining remittance (0.5% fee) + QR merchant payments (1% fee), BankID-native, pass-through — money stays in your bank. Target Market: All residents in Norway/Scandinavia who send money abroad or pay at local businesses Differentiators: Only app doing both remittance + QR; PSD2 pass-through (no wallet); BankID-native; community trust

6. Stakeholder Needs Analysis

Stakeholder Group	Primary Needs	Secondary Needs	Pain Points Addressed
Consumer users (remittance)	Cheap, reliable international transfers	Easy onboarding; recipient doesn't need app	PP-01, PP-03, PP-04
Consumer users (QR payments)	Fast, cheap local payments	Same app as remittance	PP-02, PP-03
Merchants	Lower fees than Vipps; no terminal hardware	Daily payouts; dashboard analytics	PP-02
Alem Bašić (ALAI CEO)	Product revenue; regulatory compliance	Investor/partnership readiness	BO-01, BO-05
Finanstilsynet	PSD2 compliance; consumer protection	AML/KYC standards	BO-05
BaaS partner (Swan/SpareBank1)	API adoption; transaction volume	Liability clarity	DEP-01

7. Business Requirements

ID	Requirement	Description	Priority	Rationale	BO Ref
BR-001	BankID-based identity verification	Users must verify identity via Norwegian BankID before any transaction	Must Have	Legal (SCA), AML, age verification	BO-02, BO-05
BR-002	Minimum age enforcement (18+)	System must reject users under 18 based on BankID date of birth	Must Have	Norwegian financial law; PSD2 SCA	BO-05
BR-003	Remittance to 30+ countries	Users can send money to 30+ countries at 0.5% fee	Must Have	Core revenue stream (BO-01, BO-02)	BO-01
BR-004	QR merchant payments at 1% fee	Users can pay merchants by scanning QR code; 1% merchant fee	Must Have	Core revenue stream (BO-01, BO-03)	BO-01
BR-005	PSD2 pass-through model only	Drop NEVER holds customer money; all payments via PISP from user bank	Must Have	Avoids e-money licence requirement	BO-05
BR-006	Merchant onboarding (self-service)	Merchants can register, verify KYC, receive QR code in < 5 minutes	Must Have	Merchant adoption target (BO-03)	BO-03
BR-007	GDPR-compliant data handling	All user data stored and processed in compliance with GDPR	Must Have	Legal requirement; EU regulation	BO-05
BR-008	Real-time transaction notifications	Users and merchants receive push notifications for transactions	Should Have	User trust and merchant reconciliation	BO-02, BO-03
BR-009	Transaction history with filters	Users can view all transactions with date, type, amount filters	Should Have	User experience; AML audit trail	BO-02
BR-010	AISP balance view from linked bank	Users can view bank account balance in Drop without holding funds	Should Have	User trust; shows money stays in bank	BO-02
BR-011	Merchant analytics dashboard	Merchants can view transaction volume, fees, daily totals	Should Have	Merchant retention	BO-03
BR-012	Loyalty / rewards programme	Users earn points for remittance; redeem for fee discounts	Could Have	Flywheel growth; retention	BO-02
BR-013	Multi-language support (Norwegian + English)	App available in Norwegian and English	Could Have	Accessibility for all residents	BO-02
BR-014	Virtual card (feature-flagged)	Users can order virtual Mastercard linked to bank account	Won't Have (this release)	Requires card partner; Phase 4	—

8. Success Metrics & KPIs

ID	KPI	Category	Baseline	Target	Measurement Method	Evaluation Date
KPI-01	Monthly Recurring Revenue	Revenue	0 NOK	130,000 NOK/month	Transaction logs	Month 12 post-launch
KPI-02	Registered users	Adoption	0	3,000	App analytics	Month 12 post-launch
KPI-03	Onboarded merchants	Adoption	0	200	Merchant dashboard	Month 12 post-launch
KPI-04	Remittance fee vs competitors	Competitiveness	5-10% (WU)	0.5% Drop	Fee schedule	Ongoing
KPI-05	System uptime	Reliability	N/A	≥ 99.5%	Monitoring	Ongoing post-launch
KPI-06	Payment success rate	Quality	N/A	≥ 99%	Transaction logs	Ongoing post-launch
KPI-07	Onboarding completion rate	UX	N/A	≥ 70%	Analytics funnel	30 days post-launch
KPI-08	Security score	Security	57/100 (audit 2026-02-11)	≥ 80/100	Security audit	Pre-launch

9. Business Rules & Constraints

9.1 Business Rules

ID	Rule	Category	Source	Enforced By
RUL-001	Minimum user age: 18 years	Legal	Norwegian financial law	BankID DOB validation
RUL-002	Norwegian BankID required for all users	Legal	PSD2 SCA requirement	Onboarding flow
RUL-003	Drop NEVER holds customer money	Business / Legal	ADR-003 (pass-through model)	Architecture; no wallet tables
RUL-004	NEVER use word "banking" without licence disclaimer	Legal	Legal review 2026-02-08	UI copy review
RUL-005	Remittance fee: 0.5% of transaction amount	Financial	Business model	Transaction service
RUL-006	QR merchant fee: 1% of transaction amount	Financial	Business model	Transaction service
RUL-007	Minimum remittance: 100 NOK; Maximum: 50,000 NOK per transaction	Financial / AML	Internal policy + AML	Validation layer
RUL-008	KYC approval required before first transaction	Legal	AML directive	KYC gate in transaction flow
RUL-009	GDPR: User data must not leave EEA	Legal	GDPR	Infrastructure hosting
RUL-010	PCI-DSS: Full card numbers/CVV must NEVER be stored or returned via API	Legal	PCI-DSS Level 1	Cards service tokenisation

9.2 Regulatory & Compliance Requirements

Regulation	Applicability	Key Requirements	Responsible
PSD2 (EU)	Yes	PISP/AISP licence or operating under BaaS partner licence; SCA (BankID)	John + Legal + Finanstilsynet
GDPR	Yes	Data minimisation; right to deletion; consent; DPA with BaaS provider	John + Legal
AML / AMLD6	Yes	KYC verification; transaction monitoring; suspicious activity reporting	John + KYC provider (Sumsub)
DORA (EU)	Yes	ICT risk management; incident reporting	John + Legal (2025 compliance deadline)
PCI-DSS	Partial	Card tokenisation; no CVV storage (cards feature only)	John + card partner

9.3 Technical Constraints

Must use Norwegian BankID for SCA (locks initial market to Norway)
Must use PSD2 Open Banking (AISP/PISP) — no wallet/balance storage
Must run on Vercel (landing) + Fly.io or equivalent (backend) — EEA data residency
Database must migrate from SQLite to PostgreSQL at 200+ concurrent users
All API endpoints must be rate-limited and CSRF-protected before production

10. Assumptions & Dependencies

10.1 Assumptions

#	Assumption	Risk if False	Owner
A-01	BaaS partner (Swan or SpareBank1) confirmed by Phase 2 start	Phase 2 blocked indefinitely	Alem
A-02	Finanstilsynet PISP/AISP registration process takes ~3 months	Launch delayed	Alem + Legal
A-03	Target users have Norwegian BankID and Norwegian bank account	Onboarding conversion fails	Alem (user research)
A-04	Open Banking PISP enables direct bank-to-bank transfers without holding	Architecture pivot required	John

10.2 Dependencies

#	Dependency	Type	Impact if Unavailable	Target Date	Status
DEP-01	BaaS provider (Swan / SpareBank1)	External	Phase 2+ blocked	2026-03-01	SpareBank1 pitched; Swan backup
DEP-02	Finanstilsynet PISP/AISP registration	External / Regulatory	Real payments blocked	2026-05-15	Not started
DEP-03	BankID via BaaS	External	SCA blocked	After BaaS confirmed	Pending
DEP-04	KYC provider (Sumsub)	External	AML compliance blocked	After BaaS confirmed	Mock in place

11. ROI Analysis

11.1 Investment Summary

Cost Category	One-Time (NOK)	Annual (NOK)	Notes
Development (AI-first)	10,000	~13,200	Claude Code costs
Open Banking / BaaS setup	15,000	Variable	BaaS API costs scale with volume
Legal + compliance	50,000	~20,000	Ongoing compliance
Marketing	100,000	360,000–600,000	Scaled to growth
Infrastructure	5,000	24,000	Fly.io + Vercel
Total Year 1	180,000	417,200–637,200

11.2 Benefit Projections

Benefit	Year 1 (NOK)	Year 2 (NOK)	Year 3 (NOK)	Confidence
Remittance fee revenue	360,000	960,000	1,800,000	Medium
Merchant QR fee revenue	1,200,000	3,000,000	6,000,000	Medium
Total Benefits	1,560,000	3,960,000	7,800,000

11.3 ROI Summary

Metric	Value
Total Investment (Year 1)	~250,000 NOK
Net Benefit (Year 1)	~1,310,000 NOK
Payback Period	7-9 months
3-Year ROI	~1,800%
3-Year NPV (discount rate: 10%)	~9,500,000 NOK

12. Implementation Roadmap

Phase	Description	Key Deliverables	Duration	Success Criteria
Phase 0.5 — Hardening	Security fixes; architecture cleanup	All critical security issues fixed; 217 tests green; staging live	2 weeks	Security score > 70; staging at drop-staging.fly.dev
Phase 1 — Demo App	Full 10-screen demo with mock Open Banking	Next.js app; all flows; BankID mock; investor-ready	4 weeks	Demo presentable to investors and SpareBank1
Phase 2 — Banking Integration	Real Open Banking; BankID; KYC	Real AISP + PISP; 10 beta users	8 weeks	Real bank transfers working
Phase 3 — Launch	App Store; merchant onboarding; marketing	Live on iOS + Android; 200 merchants	6 weeks	1,000 users; revenue flowing

13. Risk Assessment

#	Risk	Probability	Business Impact	Mitigation
BR-R01	BaaS partner unavailable — revenue delayed	High	High	Multi-provider; Swan backup
BR-R02	Regulatory delay (Finanstilsynet)	High	High	Early engagement; bank partner licence interim
BR-R03	Vipps launches remittance — narrows moat	Medium	High	Community trust + fees advantage; accelerate adoption
BR-R04	Slow merchant adoption — QR revenue lower than projected	Medium	Medium	Door-to-door; 0% fee launch offer

Full technical risk register: [../PROJECT-GOVERNANCE/risk-register.md](../PROJECT-GOVERNANCE/risk-register.md)

Approval

Role	Name	Date	Signature
Author	John (AI Director)	2026-02-08	Approved (AI)
Business Analyst	product agent	2026-02-08	Approved (AI)
Product Owner	John	2026-02-08	Approved
AI Director (John)	John	2026-02-23	Approved
CEO (Alem)	Alem Bašić	2026-02-08	Approved