Digital Wallet Mobile App Development
A digital wallet is a licensed payment product. Development starts not with code but business structure: either own payment operator license or partnership with a licensed bank/PSP (Banking-as-a-Service). Technically, this determines the API the mobile app uses—proprietary backend or BaaS provider.
Wallet Architecture
Two approaches:
BaaS (Banking-as-a-Service). Treezor, ClearBank, Railsbank, Modulr provide APIs for wallet creation, IBAN, transfers, card issuance. The mobile app is the frontend over their API. Faster launch, lower regulatory burden.
Own backend. Full control over transaction logic, but requires a license. Technically harder: double-entry accounting, gapless transaction log, reconciliation.
For the mobile app, the difference is minimal—work with REST API in both cases. BaaS providers often have SDKs for mobile card issuance and KYC.
KYC: Identity Verification
Without verification, the wallet operates under limits (typically 1,000–1,500 EUR/month). After KYC, full functionality.
Integrate Sumsub SDK (SumSubMobileSDK for iOS/Android): native SDK, liveness check, document scan, anti-spoofing. Alternatives: Onfido, Jumio. All three provide native Flutter SDKs.
Process in the app: select document type → photo of passport/ID spread → liveness selfie → wait for verification (1 minute to hours depending on provider). Push on KYC status change.
Important: Sumsub SDK on iOS adds ~15–20 MB due to CoreML anti-spoofing models. Account for this in size estimates.
Top-up and Withdrawal
Top-up: bank card (Stripe, Checkout.com), bank transfer (SEPA, SWIFT), cash via partner network. Card top-up is standard payment gateway SDK. SEPA transfer: user gets the wallet IBAN and transfers from their bank.
Withdrawal: to bank card (card payout API, e.g., Stripe Payouts), to IBAN. Verify withdrawal details—IBAN checksum validation (Luhn-like for IBAN), BIC lookup. Limits by KYC level.
All top-up/withdrawal operations are async. UI: "Request accepted, please wait" + push on credit/debit. Never show "Balance updated" synced—blockchain and banking don't work instantly.
P2P Transfers
Transfer by phone number, QR, or username—three mechanisms.
QR: generate QR with userId and optional amount. Formats: EMV QR (standard for payment QR) or custom deeplink wallet://pay?to=...&amount=.... Scan via AVFoundation (iOS) / ML Kit Barcode Scanning (Android). After scan: amount confirmation screen.
By phone: enter number → search user in system → confirmation screen. Don't show full recipient name until confirmation—only masked (Ivan V.). Privacy.
Transfer confirmation: biometrics or PIN. Not just "OK"—financial transactions require explicit confirmation. LocalAuthentication / BiometricPrompt.
Transaction History
Cursor-based pagination. Group by date. Types: top-up, withdrawal, transfer in/out, payment. Each transaction: unique ID, timestamp, amount, fee (if any), status, description, recipient/sender avatar/icon.
Export statement as PDF or CSV—generated on server, downloaded to device. UIDocumentInteractionController (iOS) / FileProvider (Android) for share/save.
Security
Session tokens: short-lived access token (15 min) + long-lived refresh token in Keychain/EncryptedSharedPreferences. Refresh token rotation on each update—previous invalidates.
Amount and frequency limits on the server, not client. Anomaly detection: multiple transfers in seconds → temporary block + push + email.
Certificate pinning: mandatory. Jailbreak/root detection: recommended.
Push and Notifications
Every money move: push within seconds. priority: high FCM / apns-priority: 10. Silent push for balance sync in background (content-available: 1). User opens the app—sees current balance without fetch.
Stack
Native Swift + Kotlin for maximum security and financial certification. Flutter with flutter_secure_storage, local_auth, dio when resources and deadlines are constrained. React Native similarly.
Process
Legal structure and BaaS selection → KYC integration → wallet and balance → top-up and withdrawal → P2P transfers → history and statements → security audit → launch.
Timeline Estimates
MVP (registration + KYC + card top-up + P2P + history): 10–14 weeks. Full wallet with card issuance, SEPA, currency exchange, spend analytics: 4–7 months. Cost determined after requirements analysis.