Development of a Mobile App for Microfinance Loans
A user opens the app, fills out an application in 2 minutes, scans their passport—and 15 seconds later receives approval. If a KYC step fails or a contract isn't signed due to an incorrect OTP, leads go to competitors. We build microfinance apps where regulation, scoring, and UX work as a single mechanism. Average approval time is 30 seconds after scoring, 88% of users return for repeat loans, and customer acquisition cost drops by 40% through automation.
What Makes This App More Complex Than a Standard Fintech Product?
Regulatory requirements. In Russia: MFO license, customer identification (KYC), document storage, calculation of the total cost of the loan (Federal Law on Personal Data). In Ukraine: NBU licensing. Architectural constraints: what data we collect, how we store it, how we transmit it. Scoring and decision-making: simple option—a REST call to a scoring model or a credit bureau integrator. More complex—an ML model on the backend with feature engineering from in-app behavior. The mobile part collects data: application fill time, field corrections, number of attempts—features for behavioral scoring.
How We Implement KYC and Identification
Onboarding and KYC: passport photo → OCR → data verification. For the Russian market—integration with providers like ID.ME, Tinkoff ID, Sber ID, or GISMET via ESIA. For the European market—eIDAS, Jumio, or Onfido SDK. On mobile: AVCaptureSession (iOS) / CameraX (Android) for document capture, transmission to backend for OCR, liveness check—either via provider SDK (FaceSDK, iDenfy) or custom integration. Liveness check through a third-party SDK is the fastest route: 95% of users complete identification within a minute. Custom implementation via ARKit/ARCore is more expensive but avoids vendor lock-in.
Contract signing. Qualified or simple electronic signature. For simple: SMS OTP + consent. Document—PDF generated on backend, signed with OTP code. Storage of signed PDF—in S3-compatible storage, reference in Keychain.
Disbursement and repayment. Loan disbursement—card transfer via payment gateway (YooKassa, CloudPayments, Stripe). Repayment—same infrastructure or SBP. Push notifications (APNs / FCM) 3/1 day before payment—standard regulator requirement.
How to Choose the Technology Stack?
React Native—a reasonable choice for cross-platform development. Native modules are needed for camera and liveness SDK. Flutter is also good but has fewer ready-made plugins for Russian payment gateways. React Native reduces integration time with YooKassa and CloudPayments by 40% compared to Flutter, and the cost of developing an MVP on React Native is 25-30% lower due to ready-made modules. Order development on React Native to accelerate MVP launch—contact us for a consultation.
Mobile Architecture
┌────────────────────────────────┐ │ Onboarding Flow │ │ ├── Phone verification (OTP) │ │ ├── Document scan (CameraX) │ │ ├── Liveness check (SDK) │ │ └── KYC status polling │ ├────────────────────────────────┤ │ Loan Application │ │ ├── Amount/term selector │ │ ├── Scoring request │ │ ├── Decision screen │ │ └── Contract signing (OTP) │ ├────────────────────────────────┤ │ Account / Repayment │ │ ├── Active loans list │ │ ├── Payment schedule │ │ ├── Repayment (card / SBP) │ │ └── Push reminders │ └────────────────────────────────┘ Why Is Data Security Critical?
Passport data, phone number, financial history—personal data. Federal Law 152 mandates storage on servers within Russia. The mobile app does not store PII locally beyond the session—only an auth token and biometric binding in Keychain/KeyStore. Certificate pinning is mandatory—intercepting traffic via MITM must not expose the API. We use TrustKit (iOS) or OkHttp CertificatePinner (Android). Root detection—RootBeer for Android, IOSSecuritySuite for iOS—block or warn. We ensure compliance with regulatory norms regardless of jurisdiction.
Comparison of Liveness Check SDKs
| SDK | Platforms | Liveness | Integration Time | License Cost (year) |
|---|---|---|---|---|
| FaceSDK | iOS, Android | Yes | 2-3 days | from $5000 |
| iDenfy | iOS, Android | Yes | 3-5 days | from $8000 |
| Custom (ARKit/ARCore) | iOS, Android | Yes | 4-6 weeks | from $15,000 |
Custom solutions require more resources but eliminate vendor lock-in. For a fast MVP launch, choose FaceSDK or iDenfy—they pay off through speed to market.
Checklist of Typical Mistakes When Developing Microfinance Apps
- Lack of certificate pinning—vulnerability to MITM attacks.
- Storing PII locally (SharedPreferences, UserDefaults)—violation of Federal Law 152.
- Ignoring the calculation of the total cost of the loan in the contract—regulator fines.
- Not configuring push notifications (APNs / FCM)—reduced customer return rate.
- Missing deep linking (Universal Links / App Links)—loss of ad conversion.
Process and Timeline
| Stage | What's Included | Duration |
|---|---|---|
| Requirements audit | Jurisdiction, regulation, scoring model, payment gateways | 1 week |
| Design | Architecture, API contracts, SDK selection | 1 week |
| MVP development | Onboarding + KYC + application + scoring + contract | 4-6 weeks |
| Integrations | Payment gateway, SMS, push | 1-2 weeks |
| Testing | QA, basic security audit | 1-2 weeks |
Full cycle—from 2 months for a simple MVP without liveness check to 3 months for a production-ready app. The cost of an MVP ranges from 1.2 to 2.5 million RUB depending on integration complexity. Pricing is individual after requirements analysis. Get a consultation—contact us to evaluate your project.