Market Research

Mobile Banking Research

Mobile Payment/Banking Application - Full Research Findings

Table of Contents

  1. Regulatory Requirements
  2. Technical Architecture
  3. Security & Compliance
  4. Market Analysis
  5. Key Success Factors

1. Regulatory Requirements

1.1 EU Payment Services Directive (PSD2/PSD3)

Current State (PSD2)

PSD2 has been the governing framework since 2018, establishing:

PSD3 Transition (2025-2028)

Timeline:

Key Changes in PSD3:

Compliance Actions for 2026:

  1. Implement Confirmation of Payee systems
  2. Upgrade SCA mechanisms for eIDAS 2.0 alignment
  3. Establish real-time fraud monitoring
  4. Prepare for API hardening requirements
  5. Build recovery assurance capabilities

1.2 Licensing Requirements

Electronic Money Institution (EMI) License

Capital Requirements:

Application Costs by Jurisdiction:

Country Application Fee Timeline Total Setup Cost
Lithuania EUR 1,463 6-9 months EUR 30K-50K
Malta EUR 2,000-5,000 ~6 months EUR 40K-60K
Ireland GBP 5,000 12-18 months EUR 200K-300K+
UK GBP 5,000 6-12 months EUR 100K-200K

Lithuania Advantages:

Ireland Advantages:

Payment Institution (PI) License

Alternative to EMI if not issuing e-money:

1.3 KYC/AML Requirements

EU AML Package 2025

New Framework:

Core KYC Requirements:

  1. Customer Due Diligence (CDD)

    • Identity verification (ID document + biometric)
    • Address verification
    • Source of funds verification
    • Beneficial ownership identification (UBO)

  2. Enhanced Due Diligence (EDD)

    • Required for high-risk customers/transactions
    • PEP (Politically Exposed Persons) screening
    • Ongoing monitoring requirements

  3. eKYC Standards (2025)

    • Mandatory electronic identification
    • eIDAS 2.0 compliance for digital identity
    • Remote verification capabilities required

Cash Transaction Limits:

1.4 Data Protection (GDPR)

Key Requirements for Financial Apps:

  1. Data Minimization

    • Collect only necessary data
    • Clear purpose limitation
    • Defined retention periods

  2. Privacy by Default

    • Location tracking disabled by default
    • Marketing communications opt-in only
    • Minimal data sharing defaults

  3. Consent Management

    • Explicit, active consent required
    • No pre-ticked boxes
    • Easy withdrawal mechanism
    • Granular consent options

  4. Data Subject Rights

    • Right to access (30-day response)
    • Right to portability
    • Right to erasure
    • Right to rectification

  5. Security Requirements

    • End-to-end encryption (TLS 1.3+)
    • AES-256 for data at rest
    • Data breach notification within 72 hours

  6. DPIA Requirements

    • Required for AI-powered decisions
    • Biometric authentication systems
    • Large-scale customer analytics

Penalties:

2. Technical Architecture

2.1 System Architecture Overview

Modern mobile banking requires a layered, microservices-based architecture:

┌─────────────────────────────────────────────────────────────┐
│                    PRESENTATION LAYER                        │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐  │
│  │  iOS App    │  │ Android App │  │    Web Dashboard    │  │
│  │  (Swift)    │  │  (Kotlin)   │  │     (React)         │  │
│  └─────────────┘  └─────────────┘  └─────────────────────┘  │
│         OR Cross-Platform: Flutter / React Native            │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                      API GATEWAY                             │
│  (Authentication, Rate Limiting, Load Balancing)             │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                   MICROSERVICES LAYER                        │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐   │
│  │   Auth   │ │ Accounts │ │ Payments │ │    Cards     │   │
│  │ Service  │ │ Service  │ │ Service  │ │   Service    │   │
│  └──────────┘ └──────────┘ └──────────┘ └──────────────┘   │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐   │
│  │   KYC    │ │   AML    │ │  Ledger  │ │ Notification │   │
│  │ Service  │ │ Service  │ │ Service  │ │   Service    │   │
│  └──────────┘ └──────────┘ └──────────┘ └──────────────┘   │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                    DATA LAYER                                │
│  ┌──────────────┐  ┌───────────┐  ┌─────────────────────┐   │
│  │  PostgreSQL  │  │   Redis   │  │   Event Stream      │   │
│  │  (Primary)   │  │  (Cache)  │  │   (Kafka/RabbitMQ)  │   │
│  └──────────────┘  └───────────┘  └─────────────────────┘   │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                 EXTERNAL INTEGRATIONS                        │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐   │
│  │  BaaS    │ │   Card   │ │   KYC    │ │   Payment    │   │
│  │ Provider │ │ Issuer   │ │ Provider │ │   Rails      │   │
│  └──────────┘ └──────────┘ └──────────┘ └──────────────┘   │
└─────────────────────────────────────────────────────────────┘

2.2 Payment Processing Flow

1. User Initiates Payment
         │
         ▼
2. Mobile App → API Gateway
         │
         ▼
3. Authentication Service (verify session, 2FA if required)
         │
         ▼
4. Payment Service
   ├── Validate request
   ├── Check balance/limits
   ├── AML screening (real-time)
   └── Create payment intent
         │
         ▼
5. Ledger Service
   ├── Reserve funds (pending state)
   └── Create audit trail
         │
         ▼
6. External Payment Rail (SEPA, SWIFT, card network)
         │
         ▼
7. Confirmation
   ├── Ledger finalization
   ├── User notification
   └── Transaction record

2.3 Mobile Wallet Architecture

Core Components:

  1. Wallet Container

    • Multi-currency support
    • Real-time balance tracking
    • Transaction history
    • Spending analytics

  2. Card Management

    • Virtual card generation
    • Physical card ordering
    • Card controls (freeze, limits)
    • Push provisioning (Apple/Google Pay)

  3. Payment Methods

    • NFC tap-to-pay
    • QR code payments
    • P2P transfers
    • Scheduled payments
    • Bill payments

  4. Security Layer

    • Biometric authentication
    • Device binding
    • Transaction signing
    • Tokenization

2.4 Core Banking Integration Options

Option 1: Full BaaS

Option 2: Modular Integration

Option 3: Custom Build

2.5 API-First Design Principles

  1. RESTful APIs for standard operations
  2. WebSocket for real-time updates
  3. GraphQL for complex data queries (optional)
  4. Idempotency for payment operations
  5. Versioning for backward compatibility
  6. Rate limiting for security and stability

3. Security & Compliance

3.1 PCI DSS Compliance

Compliance Levels:

Key Requirements (v4.0.1):

Requirement Description
Req 3 Protect stored cardholder data
Req 4 Encrypt transmission of cardholder data
Req 6 Develop and maintain secure systems
Req 8 Identify users and authenticate access
Req 10 Log and monitor all access
Req 11 Regularly test security systems
Req 12 Maintain information security policy

Mobile-Specific Requirements:

Non-Compliance Penalties:

3.2 Strong Customer Authentication (SCA)

Two of Three Factors Required:

  1. Knowledge: PIN, password
  2. Possession: Phone, token, card
  3. Inherence: Biometrics (fingerprint, face)

SCA Exemptions:

3.3 Security Architecture

┌─────────────────────────────────────────────────────┐
│              SECURITY LAYERS                         │
├─────────────────────────────────────────────────────┤
│ Application Security                                 │
│ ├── Input validation                                │
│ ├── Output encoding                                 │
│ ├── Session management                              │
│ └── OWASP MASVS compliance                          │
├─────────────────────────────────────────────────────┤
│ Data Security                                        │
│ ├── AES-256 encryption (at rest)                    │
│ ├── TLS 1.3 (in transit)                            │
│ ├── Tokenization (sensitive data)                   │
│ └── Key management (HSM)                            │
├─────────────────────────────────────────────────────┤
│ Infrastructure Security                              │
│ ├── WAF (Web Application Firewall)                  │
│ ├── DDoS protection                                 │
│ ├── Network segmentation                            │
│ └── Intrusion detection                             │
├─────────────────────────────────────────────────────┤
│ Operational Security                                 │
│ ├── 24/7 monitoring                                 │
│ ├── Incident response                               │
│ ├── Penetration testing                             │
│ └── Vulnerability management                        │
└─────────────────────────────────────────────────────┘

3.4 Fraud Prevention

Real-Time Monitoring:

Required Capabilities (PSD3):

4. Market Analysis

4.1 European Digital Banking Market

Market Size:

Key Players:

4.2 Competitive Landscape

Neobank Industry Statistics (2025):

Success Factors:

  1. Differentiated value proposition
  2. Superior user experience
  3. Cost-efficient operations
  4. Multiple revenue streams
  5. Strong unit economics

4.3 Revenue Models

Primary Revenue Streams:

  1. Interchange fees: 0.2-0.3% of card transactions
  2. FX markup: 0.5-2% on currency conversion
  3. Subscription tiers: EUR 5-15/month premium plans
  4. Interest income: On deposits (if banking license)
  5. Lending: Personal loans, BNPL, overdrafts

Emerging Revenue:

5. Key Success Factors

5.1 Time to Market

Critical Milestones:

Accelerators:

5.2 User Acquisition

Strategies:

  1. Referral programs: Proven effective for neobanks
  2. Niche targeting: Specific customer segments
  3. Feature differentiation: Unique value proposition
  4. Partnership distribution: Through platforms/employers

Metrics to Track:

5.3 Operational Excellence

Key Capabilities:

  1. Customer support: 24/7, multi-channel
  2. Fraud management: Real-time, ML-powered
  3. Compliance: Continuous monitoring
  4. Engineering: Rapid iteration, reliability

Cost Optimization:

Sources and References

Regulatory

Technical

Market

Banking Providers

Third-Party Providers Comparison

Architecture alignment note (2026-02-14): This document is pre-architecture research from the mobilebank-research phase. Drop ultimately chose a PSD2 pass-through model — no wallet, no balance held by Drop, no IBAN generation. BaaS providers listed here would serve as Open Banking (AISP/PISP) integration partners, not wallet infrastructure. Card issuing is a FUTURE feature (feature-flagged). This document is retained as provider research reference.

Table of Contents

  1. Banking-as-a-Service (BaaS) Providers
  2. Card Issuing Platforms
  3. Payment Processors
  4. KYC/Identity Verification Providers
  5. Virtual IBAN Providers
  6. Recommendation Matrix

1. Banking-as-a-Service (BaaS) Providers

Overview

BaaS providers enable fintech companies to offer banking services without obtaining their own banking license. They provide the regulatory infrastructure, APIs, and banking capabilities.

Provider Comparison

Solarisbank (Solaris SE)

Attribute Details
Headquarters Berlin, Germany
License Full German banking license + Digital Assets Custody
Coverage EU-wide (passporting)
Key Features Accounts, cards, lending, digital assets, compliance
Target Market Fintechs, enterprises, large card programs
Notable Clients Samsung, ADAC
Strengths Full-stack, modular APIs, banking license
Weaknesses Requires BaFin approval for new partners, financial challenges
Best For Enterprises needing complete banking capabilities

Services:

Swan

Attribute Details
Headquarters Paris, France
License EMI (French)
Coverage Eurozone (expanding)
Key Features IBANs, cards, embedded finance
Target Market Startups, SMEs, SaaS platforms
Strengths 5-minute integration, built-in KYC, fast time-to-market
Weaknesses Limited geographic coverage, cards/accounts focus
Best For Fast MVP launch, European startups

Key Differentiators:

Treezor (Societe Generale)

Attribute Details
Headquarters Paris, France
License EMI (European) + MasterCard Prepaid approved
Coverage EU (branches in Italy, Spain, Germany)
Key Features E-wallets, cards, marketplaces, crowdfunding
Target Market Neobanks, mobility, employee benefits
Strengths Backed by Societe Generale, SEPA network, 50M+ transactions/year
Weaknesses Best suited for eurozone transactions
Best For Euro-focused operations, established platforms

Services:

Railsr (formerly Railsbank)

Attribute Details
Headquarters UK
License EMI
Coverage Europe, Asia
Key Features BaaS, Cards-as-a-Service, payments, compliance
Target Market Fintechs, brands embedding finance
Strengths Flexible APIs, cards + payments combined
Weaknesses Financial challenges (acquired/recapitalized 2023)
Best For Card programs, embedded finance for brands

Other Notable Providers

Provider HQ Specialty Notes
Modulr UK Payments infrastructure EMI license, fast payments
Paynetics Bulgaria E-money, cards EU + UK licenses
Vodeno/Aion Poland/Belgium Full banking Acquired by UniCredit
OpenPayd UK Multi-currency accounts Virtual IBANs specialist

BaaS Selection Criteria

  1. Regulatory Coverage: Does license cover target markets?
  2. API Quality: Developer documentation, SDKs, sandbox
  3. Time to Market: Integration complexity, onboarding time
  4. Pricing Model: Setup fees, per-transaction, revenue share
  5. Financial Stability: Provider's funding, profitability
  6. Scalability: Can grow with your business
  7. Support: Technical support, account management

2. Card Issuing Platforms

Provider Comparison

Marqeta

Attribute Details
Headquarters US (global coverage)
Coverage 40+ countries
Key Features Virtual/physical cards, JIT funding, customization
PCI Compliance Level 1, tokenization
Pricing ~$0.50/virtual card, 0.5-1% transaction fee
Setup Cost $5,000-$50,000
Best For Custom card programs, expense management

Strengths:

Stripe Issuing

Attribute Details
Headquarters US (Ireland for EU)
Coverage US, EU expanding
Key Features Virtual/physical cards, webhooks, Stripe ecosystem
Integration Seamless with Stripe payments
Best For Existing Stripe users, developer-centric teams

Strengths:

Adyen Issuing

Attribute Details
Headquarters Netherlands
Coverage Global
Key Features Issuing + acquiring + processing combined
Integration Single API for all payment needs
Best For Enterprise with complex payment needs

Strengths:

Other Card Issuers

Provider Specialty Coverage
Paymentology Cloud-based issuing Global
Thredd (GPS) Prepaid programs EU, UK
Wallester European cards EU
Galileo Processing platform US, expanding

3. Payment Processors

Adyen

Attribute Details
Pricing Model Interchange++ (most transparent)
Processing Fee EUR 0.10-0.15 per transaction
Interchange Pass-through (EU capped: 0.2% debit, 0.3% credit)
Payment Methods Cards, local methods, wallets
Best For Large volume, international operations

Strengths:

Stripe

Attribute Details
Pricing 1.4% + EUR 0.25 (EU cards), 2.9% + EUR 0.25 (non-EU)
Features Payments, subscriptions, connect, treasury
Best For Startups, developer-first companies

Strengths:

Stripe Treasury (Embedded Finance)

Feature Capability
Financial Accounts Stored-value accounts for customers
Bank Integration Fifth Third Bank partnership
FDIC Insurance Pass-through eligible
ACH/Wire Supported
Use Case Embedded banking for platforms

Notable Implementation: Shopify Balance built on Stripe Treasury

Other Payment Processors

Provider Specialty Pricing Model
Checkout.com Enterprise payments Interchange++
Mollie European SMB Fixed % per method
Worldpay Global acquiring Custom
PayPal/Braintree Consumer payments Fixed %

4. KYC/Identity Verification Providers

Provider Comparison

Onfido

Attribute Details
Services ID scanning, facial recognition, risk scoring
Coverage Global (195+ countries)
Integration SDK (iOS, Android, Web) + API
Compliance GDPR, eIDAS, SOC 2
Best For High-volume onboarding, international

Sumsub

Attribute Details
Services KYC, AML screening, fraud prevention
Coverage 220+ countries
Features Bank verification, PEP/sanctions screening
Best For Growing fintechs, multi-region expansion

IDnow

Attribute Details
Services Video-based verification, eIDAS compliance
Coverage Europe focus
Compliance BaFin approved, full eIDAS
Best For German market, strict compliance requirements

Entrust

Attribute Details
Recognition Gartner Magic Quadrant 2025
Services AI-powered verification, digital onboarding
Best For Enterprise, banking institutions

Comparison Matrix

Provider Document Types Biometrics AML Screening Pricing Range
Onfido 4,500+ Face match Yes $$$
Sumsub 3,000+ Face + liveness Yes $$
IDnow EU focus Video + face Yes $$$
Ondato 2,000+ Photo/video Yes $$
Trulioo Global databases Limited Yes $$
iDenfy 3,000+ Face + liveness Yes $

5. Virtual IBAN Providers

Key Providers

OpenPayd

Attribute Details
IBAN Countries UK, FR, MT, NL
Features Named vIBANs, Target2 connectivity
API Simple (2 required params)
Best For Platforms needing named accounts

Banking Circle

Attribute Details
Headquarters Luxembourg
Features Named vIBANs, multi-currency (EUR, GBP, USD, AED)
Target High-volume PSPs, EMIs

Airwallex

Attribute Details
Coverage 60+ markets
Features Global accounts, FX, API automation
Best For International operations

Other Providers

Provider Specialty
Payset SME-focused, multi-currency
Clear Junction High-risk friendly
Currencycloud FX + accounts
Sharpay Instant issuance, SEPA/SWIFT

IBAN Provider Selection Criteria

  1. Coverage: Which IBAN countries needed?
  2. Naming: Named vs. pooled IBANs
  3. Payment Rails: SEPA, SWIFT, Target2
  4. Currency Support: EUR, GBP, USD, others
  5. API Quality: Documentation, reliability
  6. Compliance: AML/KYC support
  7. Pricing: Per-account, per-transaction fees

6. Recommendation Matrix

By Company Stage

Stage BaaS Cards KYC Payments
MVP/Seed Swan Stripe Issuing Sumsub Stripe
Growth Treezor/Railsr Marqeta Onfido Adyen
Enterprise Solarisbank Marqeta/Adyen IDnow Adyen

By Use Case

By Budget

Sources

MVP Specification

MVP Feature Specification

Architecture alignment note (2026-02-14): This document is pre-architecture research from the mobilebank-research phase. Drop ultimately chose a PSD2 pass-through model — no wallet, no balance held, no IBAN generation, no top-up. AISP reads bank balances, PISP initiates payments from the user's own bank account. Cards are a FUTURE feature (feature-flagged). This document is retained as research reference — it does NOT reflect the current Drop architecture.

Table of Contents

  1. MVP Philosophy
  2. Core Features
  3. Feature Specifications
  4. Timeline
  5. Success Metrics

1. MVP Philosophy

Focus Areas

What to Include

What to Exclude (MVP)

2. Core Features

Feature Priority Matrix

Feature Priority Complexity Timeline
User Onboarding P0 Medium Week 1-4
Digital KYC P0 High Week 2-6
Account Creation P0 Medium Week 4-8
IBAN Generation P0 Low Week 6-8
Virtual Card P0 High Week 8-12
P2P Transfers P0 Medium Week 10-14
Top-up (Card) P1 Medium Week 12-16
Bank Transfer P1 Medium Week 14-18
Transaction History P1 Low Week 8-10
Push Notifications P1 Low Week 10-12
Physical Card P2 High Post-MVP

3. Feature Specifications

3.1 User Onboarding

Goal: Complete signup in <3 minutes

Flow:

  1. Download app
  2. Enter phone number
  3. Verify via OTP
  4. Enter email
  5. Set password/PIN
  6. Accept T&C
  7. Start KYC

Requirements:

Acceptance Criteria:

3.2 Digital KYC (Know Your Customer)

Goal: Verify identity in <5 minutes

Flow:

  1. Select ID document type
  2. Capture front of ID
  3. Capture back of ID (if applicable)
  4. Take selfie (liveness check)
  5. Enter personal details
  6. Verification processing
  7. Result notification

Document Types:

Requirements:

Integration: Sumsub or Onfido API

Acceptance Criteria:

3.3 Account Creation

Goal: Generate EUR account with IBAN

Flow:

  1. KYC approved
  2. Account type selection (Personal)
  3. IBAN generation
  4. Account activated
  5. Welcome notification

Account Features:

Integration: BaaS provider (Swan/Treezor)

Acceptance Criteria:

3.4 IBAN Generation

Technical Requirements:

Provider Options:

Formats:

3.5 Virtual Card Issuing

Goal: Instant virtual Mastercard/Visa

Features:

Card Controls:

Security:

Integration: Marqeta or Stripe Issuing

Acceptance Criteria:

3.6 P2P Transfers

Goal: Send money to other users instantly

Transfer Types:

A) Internal (App-to-App)

B) SEPA Transfer

Flow:

  1. Select recipient method
  2. Enter/select recipient
  3. Enter amount
  4. Review details
  5. Authenticate (biometric/PIN)
  6. Confirmation

Requirements:

Limits (MVP):

Type Daily Monthly
Internal EUR 5,000 EUR 20,000
SEPA EUR 2,000 EUR 10,000

3.7 Top-up Methods

A) Card Top-up

B) Bank Transfer

C) Future: Apple Pay / Google Pay top-up

Integration: Stripe or Adyen for card payments

3.8 Transaction History

Features:

Categories:

3.9 Push Notifications

Mandatory Notifications:

Optional Notifications:

4. Timeline

Phase 1: Foundation (Months 1-2)

Week 1-4:

Week 5-8:

Phase 2: Core Features (Months 3-4)

Week 9-12:

Week 13-16:

Phase 3: Launch Prep (Months 5-6)

Week 17-20:

Week 21-24:

Milestones

Milestone Target Date Deliverable
Alpha Month 3 Core features working
Beta Month 5 500 beta users
Soft Launch Month 6 Public availability
GA Month 7-8 Marketing push

5. Success Metrics

Activation Metrics

Metric Target Threshold
Signup completion >80% >60%
KYC pass rate >85% >70%
First transaction >50% in 7 days >30%
Card activation >70% >50%

Engagement Metrics

Metric Target Threshold
MAU/DAU >30% >20%
Transactions/user/month >10 >5
App opens/week >3 >1

Quality Metrics

Metric Target Threshold
App crash rate <0.5% <1%
API latency (p95) <500ms <1000ms
Uptime >99.9% >99.5%
App store rating >4.5 >4.0

Business Metrics

Metric Target Threshold
CAC <EUR 30 <EUR 50
Monthly burn <EUR 50K <EUR 75K
Active users (6 months) >5,000 >2,000

Sources

Cost Analysis

Cost Breakdown and Budget Estimates

Architecture alignment note (2026-02-14): This document is pre-architecture research from the mobilebank-research phase. Drop ultimately chose a PSD2 pass-through model — no wallet, no balance held, no own EMI license required for MVP. The pass-through model significantly reduces licensing and BaaS costs compared to the scenarios below. Card issuing is a FUTURE feature. This document is retained as cost research reference — actual Drop cost structure differs.

Table of Contents

  1. Executive Summary
  2. Licensing Costs
  3. Development Costs
  4. Third-Party Provider Costs
  5. Infrastructure Costs
  6. Operational Costs
  7. Budget Scenarios

1. Executive Summary

Total Investment Range

Approach Initial (Year 1) Monthly Ops Break-even
BaaS MVP EUR 150K-300K EUR 15-30K 18-24 months
Full Build EUR 500K-1.5M EUR 50-100K 24-36 months
Enterprise EUR 1.5M+ EUR 100K+ 36+ months

Key Cost Drivers

  1. Licensing strategy (own vs. BaaS)
  2. Development approach (in-house vs. outsource)
  3. Feature complexity
  4. Geographic scope
  5. Transaction volume

2. Licensing Costs

Option A: Own EMI License

Jurisdiction Application Capital Setup (Legal/Consulting) Timeline
Lithuania EUR 1,463 EUR 350,000 EUR 30-50K 6-9 months
Malta EUR 2-5K EUR 350,000 EUR 40-60K 6 months
Ireland EUR 4K EUR 350,000 EUR 200-300K 12-18 months
UK (FCA) GBP 5,000 GBP 350,000 GBP 100-200K 6-12 months

Lithuania Breakdown:

Option B: BaaS Partnership (No Own License)

Provider Setup Fee Monthly Minimum Per-Transaction
Swan EUR 0-10K EUR 500-2K Volume-based
Treezor EUR 10-50K EUR 2-5K Volume-based
Solarisbank EUR 50-100K EUR 5-10K Custom

Savings with BaaS:

3. Development Costs

MVP Development (4-6 months)

Component In-House (Western EU) Outsource (Eastern EU) Outsource (Asia)
Backend EUR 80-120K EUR 40-60K EUR 25-40K
Mobile (Flutter) EUR 60-100K EUR 30-50K EUR 20-35K
Frontend (Web) EUR 30-50K EUR 15-25K EUR 10-18K
DevOps/Infra EUR 20-40K EUR 10-20K EUR 8-15K
QA/Testing EUR 20-30K EUR 10-15K EUR 6-10K
Total EUR 210-340K EUR 105-170K EUR 69-118K

Feature-Level Costs

Feature Development Cost Notes
User onboarding EUR 8-15K Auth, registration
KYC integration EUR 15-30K Third-party API
Account management EUR 20-35K Core functionality
Virtual card EUR 25-40K Issuing integration
P2P transfers EUR 15-25K Internal + SEPA
Card top-up EUR 10-20K Payment gateway
Push notifications EUR 5-10K FCM/APNS
Transaction history EUR 8-12K UI + backend
Card controls EUR 10-15K Freeze, limits

Team Composition (MVP)

Role Count Monthly Cost (EU)
Tech Lead 1 EUR 8-12K
Backend Dev (Senior) 2 EUR 12-18K
Mobile Dev (Senior) 2 EUR 12-18K
DevOps 1 EUR 6-9K
QA 1 EUR 4-6K
Product Manager 1 EUR 6-10K
Designer 0.5 EUR 3-5K
Total 8.5 EUR 51-78K/month

Outsourcing Savings: 40-60% vs. Western EU rates

4. Third-Party Provider Costs

BaaS Provider Costs

Provider Setup Monthly Per Account Notes
Swan Free-10K EUR 500-2K EUR 0.50-2 Fast integration
Treezor EUR 10-30K EUR 2-5K Included SEPA optimized
Solarisbank EUR 50-100K EUR 5-10K Custom Full stack

Card Issuing Costs

Provider Setup Per Card Transaction Fee
Marqeta EUR 5-50K EUR 0.50-2 0.5-1%
Stripe Issuing Free EUR 0.10-0.50 Included
Adyen Custom Custom Custom

KYC/Identity Verification

Provider Per Verification Volume Discount
Sumsub EUR 0.50-2.00 Yes (>10K/month)
Onfido EUR 1.00-3.00 Yes
IDnow EUR 2.00-5.00 Yes

Example (10K users/month):

Payment Processing

Provider Setup Per Transaction Notes
Stripe Free 1.4% + EUR 0.25 (EU) Easy integration
Adyen Free EUR 0.10-0.15 + interchange Enterprise

Virtual IBAN

Provider Per IBAN Monthly Maintenance
OpenPayd EUR 1-5 EUR 0-1
Banking Circle Custom Volume-based
Usually included in BaaS - -

5. Infrastructure Costs

Cloud Infrastructure (AWS/GCP)

Component Monthly Cost Notes
Compute (K8s cluster) EUR 1,500-3,000 3-5 nodes
Database (RDS/Cloud SQL) EUR 500-1,500 Multi-AZ
Redis (ElastiCache) EUR 200-500 Cluster mode
Storage (S3) EUR 100-300 Documents, backups
CDN (CloudFlare) EUR 200-500 Pro/Business
Monitoring (Datadog) EUR 300-800 APM included
Total EUR 2,800-6,600 Scales with users

Cost Per User

Users Infrastructure Third-Party Total/User
1,000 EUR 3/user EUR 5/user EUR 8/user
10,000 EUR 1/user EUR 3/user EUR 4/user
100,000 EUR 0.50/user EUR 2/user EUR 2.50/user

6. Operational Costs

Monthly Operational Expenses

Category MVP Phase Growth Phase Scale Phase
Team (salaries) EUR 30-50K EUR 80-150K EUR 200K+
Infrastructure EUR 3-5K EUR 10-20K EUR 50K+
Third-party services EUR 5-10K EUR 20-50K EUR 100K+
Compliance EUR 5-10K EUR 15-30K EUR 50K+
Customer support EUR 2-5K EUR 10-20K EUR 30K+
Marketing EUR 5-15K EUR 30-100K EUR 200K+
Legal/Professional EUR 2-5K EUR 5-15K EUR 20K+
Office/Admin EUR 2-5K EUR 5-10K EUR 15K+
Total EUR 54-105K EUR 175-395K EUR 665K+

Per-User Economics

Metric Amount Notes
Customer Acquisition Cost EUR 20-50 Marketing + onboarding
First-year serving cost EUR 175 Fixed costs
Monthly serving cost EUR 5 Infrastructure + support
Required spend for breakeven EUR 750/month Year 1

Compliance Costs

Item Annual Cost
Compliance Officer (FTE) EUR 80-120K
AML monitoring tools EUR 20-50K
External audits EUR 30-60K
Regulatory reporting EUR 10-20K
Training & certification EUR 5-10K
Total EUR 145-260K

7. Budget Scenarios

Scenario A: Lean BaaS MVP

Assumptions:

Category Year 1 Monthly (Avg)
Development EUR 150,000 -
BaaS setup + fees EUR 20,000 EUR 2,000
KYC (5K verifications) EUR 10,000 EUR 1,000
Infrastructure EUR 36,000 EUR 3,000
Operations (lean) EUR 120,000 EUR 10,000
Marketing EUR 60,000 EUR 5,000
Legal/Compliance EUR 30,000 EUR 2,500
Buffer (15%) EUR 64,000 -
Total Year 1 EUR 490,000 EUR 23,500

Scenario B: Standard Build

Assumptions:

Category Year 1 Monthly (Avg)
EMI License EUR 450,000 -
Development EUR 300,000 -
Card program EUR 50,000 EUR 5,000
KYC (20K verifications) EUR 30,000 EUR 3,000
Infrastructure EUR 72,000 EUR 6,000
Operations EUR 480,000 EUR 40,000
Marketing EUR 200,000 EUR 17,000
Legal/Compliance EUR 150,000 EUR 12,500
Buffer (20%) EUR 346,000 -
Total Year 1 EUR 2,078,000 EUR 83,500

Scenario C: Enterprise Launch

Assumptions:

Category Year 1
EMI License (Ireland) EUR 800,000
Development EUR 800,000
Core banking platform EUR 300,000
Card program EUR 150,000
KYC (100K verifications) EUR 100,000
Infrastructure EUR 300,000
Operations EUR 1,500,000
Marketing EUR 1,000,000
Legal/Compliance EUR 400,000
Buffer (25%) EUR 1,337,500
Total Year 1 EUR 6,687,500

Cost Optimization Strategies

Development

Licensing

Operations

Marketing

Financial Model Summary

Unit Economics Target

Metric Target
CAC < EUR 30
LTV > EUR 150
LTV:CAC > 5:1
Payback period < 12 months
Gross margin > 60%

Revenue Model

Stream Revenue/User/Year
Interchange EUR 15-30
FX markup EUR 10-20
Premium subscription EUR 60-120
Interest income EUR 5-15
Total potential EUR 90-185

Break-even Analysis

Scenario Users Required Timeline
BaaS MVP 5,000-10,000 18-24 months
Standard 20,000-30,000 24-36 months
Enterprise 50,000+ 36+ months

Sources

Technology Stack

Technical Stack Recommendations

1. Architecture Overview

Principles

  1. Microservices Architecture - Modular, independently deployable
  2. Cloud-Native Design - Containerized, elastic scaling
  3. Security by Design - Zero-trust, encryption everywhere

2. Backend Technology

Primary: Java/Spring Boot

Secondary: Node.js

Hybrid Approach

3. Mobile Development

Recommendation: Flutter

Criteria Flutter React Native Native
Performance Near-native Good Best
Code Sharing 95%+ 85-90% 0%
Market Share 46% 35% -

Why Flutter:

Stack: Bloc, GoRouter, Dio, Hive, local_auth

4. Database & Storage

5. Infrastructure

Cloud: AWS or GCP

Components:

6. Security

OWASP MASVS

7. MVP Stack

BankID & Vipps Research

BankID and Vipps Login Authentication Research

Research Date: 2026-02-15 Project: Drop Fintech App Purpose: Evaluate feasibility of integrating BankID and Vipps as authentication methods

Executive Summary

Both BankID and Vipps Login are viable authentication options for Drop. Both support OIDC/OAuth2 integration with Next.js, have test environments, and can serve dual purposes as both authentication and PSD2 Strong Customer Authentication (SCA).

Critical Timeline Note: BankID is undergoing major changes with an April 1, 2026 deadline for migration to new infrastructure.

Key Considerations:

1. Norwegian BankID

What is it?

BankID is Norway's leading electronic identification system, issued through Norwegian banks. It enables secure authentication and digital signatures. BankID supports both traditional methods and the newer BankID with Biometrics (app-based solution using WebAuthn).

Major Change in 2026: BankID is moving to a single issuer (Stø AS) with critical infrastructure changes taking effect April 1, 2026. All integrations must migrate to the new Digital Trust Platform and OIDC-based approach before this deadline.

Integration Method

Technical Requirements:

Reference Implementation: GitHub - BankID OIDC Integration Examples

Requirements to Get Access

Mandatory Prerequisites:

  1. Company must be a customer of a Norwegian bank (within BankID network)
  2. Person signing the contract must have personal eID (Norwegian BankID, Swedish BankID, or Danish MitID)
  3. Completed "Getting Ready for Production" guide (step 5) to obtain production domain
  4. Register application in BankID Developer Portal (freely available)

Application Information Required:

Agreement Process:

  1. Submit application information
  2. Provider sends online agreement for signing
  3. Signed agreement forwarded to your bank for processing
  4. Bank issues client credentials

Cost

Direct from BankID Norge (Reseller Model):

Via Idura/Criipto Aggregator:

NEEDS VERIFICATION: Direct BankID pricing may have changed. Contact BankID Norge for current 2026 pricing.

Technical Complexity

Difficulty Level: Medium

Pros:

Cons:

Estimated Integration Time: 2-4 weeks (including testing and certification)

Timeline

Application to Production:

Critical Dates:

Action Required: Complete migration to Digital Trust Platform before April 1, 2026.

Sandbox/Test Environment

Test Access: Freely available

Test Environment Details:

Testing Tools:

Support: developer@bankidnorge.no

PSD2 Relevance

SCA Compliance: YES - Fully compliant

BankID with biometrics is approved for payments and meets Strong Customer Authentication (SCA) requirements according to PSD2 and 3D Secure standards.

Technical Details:

Use Cases for Drop:

  1. User authentication/login
  2. PSD2 payment authorization (SCA)
  3. Combined auth + payment flow

Alternative Providers

Aggregator Services (Recommended):

  1. Idura (formerly Criipto)

    • Bundles BankID + Vipps + other Nordic eIDs
    • Single integration point for multiple providers
    • Pricing: €65-€390/month + per-transaction fees
    • Website: idura.eu

  2. Signicat

    • Largest BankID provider in Norway (established 2007)
    • Enterprise-focused solution
    • Offers authentication + digital signatures
    • Pricing: Contact for quote
    • Website: signicat.com

  3. Curity

    • Identity platform with Norwegian BankID support
    • OIDC authenticator approach
    • Enterprise-grade solution
    • Website: curity.io

Recommendation: For Drop's use case (fintech startup), Idura offers the best balance of simplicity, cost-effectiveness, and multi-provider support.

2. Vipps Login

What is it?

Vipps is Norway's #1 mobile payment provider with near-ubiquitous adoption. Vipps Login is an authentication service that allows users to log in using their mobile number. The brand split: Vipps (Norway/Sweden) and MobilePay (Denmark/Finland) use the same API under Vipps MobilePay.

Scope: Login API confirms customer identity and provides access to verified data: name, birthdate, social security number, address, email, phone number.

Integration Method

Implementation Example:

import NextAuth from "next-auth"
import Vipps from "next-auth/providers/vipps"

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [Vipps],
})

Test Mode Override:

Vipps({ issuer: "https://apitest.vipps.no/access-management-1.0/access/" })

Key Endpoint:

Requirements to Get Access

Application Process:

  1. Order product at vippsmobilepay.com
  2. Complete "Login checklist" for direct integration
  3. Partner application review
  4. Receive test credentials via email (test phone number + national identity number)

Company Requirements:

Technical Setup:

Cost

Per-Transaction Pricing:

Via Idura Aggregator:

Notes:

Technical Complexity

Difficulty Level: Low-Medium

Pros:

Cons:

Estimated Integration Time: 1-2 weeks

Timeline

Application to Production:

Recommendation: Contact Vipps developer support for exact onboarding timeline.

Sandbox/Test Environment

Test Environment: Merchant Test (MT) - Available to all API merchants

Access Details:

Test User Credentials:

Limitations:

Suitable For: Websites, e-commerce, apps, loyalty programs

PSD2 Relevance

SCA Compliance: YES - Fully compliant

Vipps has implemented PSD2-compliant Strong Customer Authentication with regulatory-approved delegated SCA from card issuers.

Technical Details:

Use Cases for Drop:

  1. User authentication/login
  2. PSD2 payment authorization
  3. Simplified payment flow (no separate 3DS step needed)

Advantage: Vipps SCA is transparent to users (already authenticated in app), creating smoother UX than traditional 3DS flows.

Alternative Providers

Same aggregators as BankID:

  1. Idura (formerly Criipto)

    • Bundles Vipps with BankID and other eIDs
    • Single integration, multiple auth methods
    • Transparent pricing model

  2. Signicat

    • Enterprise solution
    • Combined authentication suite
    • Contact for pricing

Recommendation: If implementing both BankID AND Vipps, use Idura aggregator to manage both via single integration point.

3. Aggregator Comparison

Why Use an Aggregator?

Benefits:

  1. Single integration point for multiple eID providers
  2. Simplified SDK/API (abstraction layer)
  3. Unified billing and reporting
  4. Faster time-to-market
  5. Reduced maintenance burden
  6. Future-proof (easy to add more eID methods)

Trade-offs:

  1. Additional monthly platform fee (€65-€390)
  2. Dependency on third-party service
  3. Potential slight latency increase

Idura (Criipto) - Recommended

What is it: European eID verification platform (formerly Criipto, rebranded to Idura)

Supported eIDs:

Pricing Structure:

Technical:

Best For: Drop's use case - need both BankID + Vipps with potential Nordic expansion

Signicat - Enterprise Alternative

What is it: Europe's largest eID and signature provider (established 2007)

Position: Largest BankID provider in Norway

Pricing: Contact for quote (not publicly listed)

Best For: Large enterprises, complex compliance needs, high-volume applications

Direct Integration vs Aggregator

For Drop, Recommend: Idura Aggregator

Reasoning:

  1. Supports both BankID and Vipps through one integration
  2. Transparent pricing (€140/month Medium tier likely sufficient)
  3. Future-proof for Nordic expansion
  4. Faster development (proven SDK)
  5. Lower maintenance burden
  6. Cost-effective at expected volume (<10,000 logins/month)

Break-even Analysis:

4. Implementation Recommendations

Phase 1: Email + Password (MVP)

Phase 2: Add BankID (Primary eID)

Phase 3: Add Vipps Login (Alternative)

Phase 4: Optimize Flow

Technical Architecture

Next.js 16 App Router
├─ Auth.js (NextAuth v5) - OIDC client
├─ Idura Verify - eID aggregator
│  ├─ Norwegian BankID
│  └─ Vipps Login
├─ jose - JWT signing/verification
└─ PostgreSQL - user sessions

Flow:

  1. User clicks "Log in with BankID" or "Log in with Vipps"
  2. Next.js redirects to Idura OIDC endpoint
  3. Idura redirects to BankID/Vipps
  4. User authenticates
  5. Idura returns to callback with ID token
  6. Next.js validates token, extracts claims (name, SSN, email)
  7. Create/update user in database
  8. Issue JWT session token (jose)
  9. User authenticated

Security Considerations:

Timeline Estimate

Development Timeline:

Total: 8 weeks to production-ready dual eID authentication

Cost Projection (First Year)

Assumptions:

Calculation:

At Scale (10,000 users):

Conclusion: Cost scales linearly with users, remains affordable for fintech startup.

5. Risks and Mitigations

BankID Migration Risk (Critical)

Risk: April 1, 2026 deadline for Digital Trust Platform migration

Impact: Service disruption if not migrated in time

Mitigation:

Age Verification Accuracy

Risk: Users might bypass age check with email/password

Mitigation:

User Adoption

Risk: Users unfamiliar with eID login may abandon signup

Mitigation:

Service Availability

Risk: BankID/Vipps downtime prevents login

Mitigation:

Regulatory Changes

Risk: PSD2/eIDAS requirements may change

Mitigation:

6. Questions Needing Verification

The following points require direct contact with providers for confirmation:

  1. BankID Direct Pricing: Current 2026 per-transaction costs (NOK 8,300/month model unclear on variable costs)
  2. Vipps Timeline: Exact onboarding timeline from application to production
  3. Vipps Active Users Model: Current 2026 pricing structure for active users billing
  4. Idura Large Tier: Volume thresholds for Small/Medium/Large tiers
  5. Minimum Requirements: Specific business registration requirements for Vipps merchant account
  6. SCA Dual-Use: Confirm BankID/Vipps can be used for BOTH login and payment authorization in same session
  7. April 2026 Migration: Detailed requirements if integrating direct BankID (not via aggregator)

7. Final Recommendation

Recommendation: Implement BOTH BankID and Vipps via Idura aggregator

Justification:

  1. Regulatory Compliance: BankID satisfies identity verification (18+, Norwegian resident)
  2. User Preference: Vipps more familiar, offers free login option
  3. PSD2 Dual-Use: Both serve as authentication AND SCA for payments
  4. Cost-Effective: Idura cheaper than direct integration until high volume
  5. Risk Mitigation: Idura handles April 2026 BankID migration
  6. Future-Proof: Easy to add Swedish/Danish eIDs for Nordic expansion
  7. Development Speed: Faster implementation with proven SDK

Implementation Priority:

  1. Phase 1: Email/Password (MVP launch)
  2. Phase 2: BankID via Idura (compliance requirement)
  3. Phase 3: Vipps via Idura (user convenience)

Next Steps:

  1. Contact Idura sales for Medium tier quote and setup
  2. Register test account and explore SDK documentation
  3. Validate integration with Next.js 16 App Router
  4. Architect user database schema (with eID verification fields)
  5. Implement BankID flow first (higher priority for compliance)
  6. Add Vipps as alternative option
  7. Load test authentication flow
  8. Production deployment with monitoring

Sources

BankID Sources

Vipps Sources

PSD2/SCA Sources

Aggregator Sources

Report Prepared By: John (AI Director) Last Updated: 2026-02-15 Status: Research complete, awaiting approval for implementation

Cloud Cost Analysis

Drop — Cloud Deployment Cost Analysis

Date: 2026-02-11 Author: John (AI Director) Status: Historical — superseded by ADR-014 (PostgreSQL-only) and ADR-012 (AWS App Runner)

NOTE (2026-03-03): This analysis was written before ADR-014 mandated PostgreSQL 16 in all environments. SQLite references below reflect the old architecture and are no longer valid. Current deployment: AWS App Runner + AWS RDS PostgreSQL 16. See ADR-012 and ADR-014.

Current Tech Stack

Layer Tech Production Note
App Next.js 16 (App Router) Monolith, ~7 pages + API
Frontend React 19 + Tailwind v4 SSR/SSG
DB SQLite (better-sqlite3) Must migrate to PostgreSQL for production
Auth JWT (jose) httpOnly cookie OK for production
Dependencies bcryptjs, radix-ui, lucide, sonner Lightweight
Dev server Port 3001 (configured in project.json) Currently running locally

Key constraint: SQLite cannot handle concurrent writes (ADR-001). Must switch to PostgreSQL before launch.

Phase 1: MVP / Demo (now → 200 users)

Provider Plan Price/mo Notes
Vercel Pro Next.js native $20 (~215 NOK) No persistent FS — SQLite won't work without Turso/Neon
Railway Starter Next.js + persistent disk $5 + usage (~160 NOK) SQLite works here
Fly.io Hobby LiteFS support $5 + usage (~160 NOK) Great for SQLite
Hetzner VPS (shared) On same CPX41 +~0 NOK If already provisioned from system migration

Recommended Phase 1 Stack

Item Provider Cost/mo
App hosting Hetzner VPS (shared) or Railway 0-160 NOK
DB SQLite (local) 0
Domain getdrop.no (one.com) ~100 NOK/yr
SSL Let's Encrypt / Cloudflare 0
Total Phase 1 ~10-170 NOK/mo

Phase 2: Launch (200-3,000 users)

SQLite → PostgreSQL migration required. Need transactional email and SMS for auth.

Item Provider Cost/mo
App hosting Railway or Fly.io $10-20 (~110-215 NOK)
PostgreSQL managed Neon free→Pro $19 or Supabase free→$25 0-270 NOK
Transactional email Resend (3,000 free/mo) → $20 0-215 NOK
SMS (OTP auth) Twilio ~$0.05/SMS × 500/mo ~270 NOK
CDN Cloudflare Free 0
Monitoring Sentry free tier 0
BaaS (Wise API) Per-transaction fee Covered by tx fees
Total Phase 2 ~400-1,000 NOK/mo

Phase 3: Scale (3,000-15,000 users)

Fintech = reliability, backups, WAF, logging required.

Item Provider Cost/mo
App hosting (2 instances) Railway Pro or Fly.io $30-50 (~325-540 NOK)
PostgreSQL managed (HA) Neon Pro $69 or Supabase Pro $25+usage 270-750 NOK
Redis (caching/sessions) Upstash free→$10 0-110 NOK
Transactional email Resend Pro $20 215 NOK
SMS (OTP) Twilio × 3,000/mo ~1,600 NOK
CDN + WAF Cloudflare Pro $20 215 NOK
Monitoring Sentry Team $26 280 NOK
Logging Betterstack free→$25 0-270 NOK
Backup storage Backblaze B2 55 NOK
BaaS APIs (Wise/Thunes/Swan) Per-tx, variable Covered by tx fees
Total Phase 3 ~3,000-4,000 NOK/mo

Summary

Phase Users Infra cost/mo MRR (from business case) Margin
MVP 0-200 10-170 NOK 0-12,000 NOK — (pre-revenue)
Launch 200-3,000 400-1,000 NOK 12,000-130,000 NOK 90%+
Scale 3,000-15,000 3,000-4,000 NOK 130,000-650,000 NOK 97%+

Infrastructure cost is negligible vs revenue. Fintech margins on infra are excellent — biggest costs are marketing (30-50K/mo) and compliance, not hosting.

Shared Hetzner VPS Option

Drop can run on the same Hetzner CPX41 (from system migration analysis) for +0 NOK incrementally:

Only at 3,000+ users should Drop move to dedicated infrastructure.