PROPELOO

NEOBANK / DIGITAL BANKING PLATFORM

Build a digital bank that competes on product, not just price.

PROPELOO engineers neobanking platforms — from core ledger architecture and payment rail integration through KYC/AML compliance, card issuance, account management and the mobile experience that determines whether users actually switch to your bank. A neobank is not a fintech with a banking licence. It is a technology product that happens to be regulated as a bank.

The neobank ledger is not a database. It is an immutable record of financial truth — and every entry must be correct forever.

Traditional banks failed on user experience. Neobanks are winning on it. But the user experience is built on top of a financial infrastructure that must be correct to the penny, available 99.99% of the time, compliant with regulations across every market you operate in, and auditable for years after every transaction. The core ledger, the payment rail integration, the reconciliation system and the compliance infrastructure are not backend details — they are the product. A neobank with a beautiful mobile app and a broken ledger will lose customer funds and regulatory licences. PROPELOO builds neobanking infrastructure where the ledger is correct, the payments are reliable, and the compliance is built in.

The full neobanking platform stack.

A production neobank has seven distinct engineering domains, each with financial-grade reliability requirements.

System Layers

  • Core Ledger Layer: Double-entry bookkeeping, event-sourced transaction log, balance calculation, reconciliation
  • Account Management Layer: Account creation, product configuration, account lifecycle, statement generation
  • Payment Rails Layer: ACH/SEPA/UPI/Swift integration, payment routing, settlement, reconciliation
  • Card Issuance Layer: Virtual/physical card issuance, authorisation processing, transaction dispute handling
  • Compliance Layer: KYC/AML, transaction monitoring, regulatory reporting, sanctions screening

Core Technical Capabilities

  • Core Banking Ledger

    Event-sourced double-entry ledger — every transaction is an immutable event, balances are derived from event history. Idempotent transaction processing, atomic multi-leg entries, audit trail for regulatory examination and reconciliation against payment rail statements.

  • Account Management System

    Multi-product account support (current, savings, fixed deposit), account lifecycle management (open, freeze, close), configurable interest accrual, fee charging, statement generation and account aggregation views.

  • Payment Rail Integration

    ACH (US), SEPA (EU), Faster Payments (UK), UPI (India), SWIFT for international wires. Real-time payment confirmation where rail supports it. Automated reconciliation against settlement files. Failure handling and retry logic for each rail's error taxonomy.

  • Card Programme Management

    Virtual and physical card issuance via Marqeta, Galileo or Stripe Issuing. Real-time authorisation decisioning, spending controls (limits, merchant category blocks), transaction dispute management and chargeback workflows.

  • KYC/AML Programme

    Identity verification (liveness + document check), beneficial ownership for business accounts, PEP/sanctions screening, transaction monitoring rules, SAR filing workflow and regulatory reporting automation.

  • Mobile Banking Application

    React Native app with biometric auth, real-time push notifications for transactions, account management, payment initiation, card controls and customer support integration.

How we think about neobanking architecture.

Financial software has two properties that most software does not: it must be correct to the penny for the entire lifetime of the institution, and it must be auditable by regulators who will not accept "the data was hard to query."

  • Event sourcing is the correct ledger architecture

    A mutable-state ledger (update the balance on every transaction) loses history and cannot be reconstructed from first principles. An event-sourced ledger stores every transaction as an immutable event — the current balance is the sum of all events. This provides: complete audit trail, ability to replay history for reconciliation, ability to correct errors via compensating entries (not deletions), and temporal queries ("what was this account's balance on March 15?"). Event sourcing adds complexity but is the correct choice for any financial ledger that must be auditable.

    Axiom:

  • Idempotency prevents double-crediting

    A payment webhook delivered twice must not result in two credits. An API retry must not result in duplicate transactions. Every financial operation must be idempotent — identified by a unique transaction ID that the system checks before processing. This is not a nice-to-have. It is a correctness requirement. A neobank that double-credits accounts loses money. A neobank that double-debits accounts loses customers and faces regulatory action.

    Axiom:

  • Payment rails have their own failure taxonomy

    ACH returns have 80+ reason codes, each requiring different handling. SEPA rejections follow ISO 20022 codes with specific regulatory response requirements. Swift messages have their own message types and processing rules. Each payment rail is its own integration domain with its own error handling, reconciliation format and regulatory reporting requirements. One engineer who "knows payments" is not sufficient — each rail requires specific domain expertise.

    Axiom:

  • Compliance is not a feature toggle

    KYC, AML transaction monitoring, sanctions screening and regulatory reporting are not optional modules you enable when you get your banking licence. They must be designed into the data model and transaction processing pipeline from day one. Adding AML transaction monitoring after 100,000 transactions have been processed requires retroactively evaluating historical data against rules that should have been applied at the time. Regulators are not sympathetic to retroactive compliance.

    Axiom:

The neobanking architecture decisions that matter.

These choices define correctness, regulatory standing and operational cost.

  • Core ledger architecture?

    Impact: Event-sourced ledger for greenfield neobanks — the long-term correctness and auditability benefits outweigh the initial complexity. Third-party core banking (Mambu, Thought Machine) for teams that want to focus on product differentiation and treat core banking as a commodity.

    • Event sourcing — immutable transaction log, audit trail, reconciliation from history, higher complexity
    • CQRS + event store — command/query separation, read model optimisation, same immutability benefits
    • Mutable state with audit log — simpler, balance updates in place, audit log separate
    • Third-party core banking (Mambu, Thought Machine) — faster to market, licensing cost, less control
  • Banking-as-a-service partner vs own licence?

    Impact: BaaS partner to validate product-market fit before licence application. Own EMI licence once volume justifies the regulatory overhead and capital requirements. National banking licence only for markets where EMI is insufficient for target products (deposit insurance, credit products).

    • BaaS partner (Railsr, Unit, Synapse) — fastest to market, regulated entity risk, revenue share
    • E-money institution licence (EU) — own licence, 6-18 month process, full control
    • National banking licence — highest capability, 1-3 year process, significant capital requirements
    • Partnership with incumbent bank — faster than own licence, bank's risk appetite limits product
  • Payment rail strategy?

    Impact: Start with the payment rails your primary user base needs. US consumer: ACH + RTP. EU: SEPA Credit Transfer + SEPA Instant. International: SWIFT. Each rail is a significant integration effort — add rails as user demand justifies them.

    • Single rail (ACH or SEPA) — simplest, limited to domestic payments
    • Domestic + SWIFT for international — covers most use cases
    • Multi-rail (ACH + RTP + SWIFT) — redundancy and speed options
    • Banking-as-a-service for payment rails — faster integration, per-transaction cost
  • Card issuance approach?

    Impact: Stripe Issuing for fastest time to market. Marqeta for products that need sophisticated real-time authorisation controls (spend analytics, category blocking, budget enforcement). Own BIN sponsorship only at scale where per-transaction costs justify the operational investment.

    • Marqeta — most flexible authorisation controls, highest cost
    • Galileo — comprehensive card programme, US-focused
    • Stripe Issuing — easiest integration, lower flexibility, higher per-transaction cost
    • Own BIN sponsorship — full control, significant regulatory and operational overhead
  • KYC/AML approach?

    Impact: Alloy or Unit21 for most neobanks — they provide orchestration across multiple underlying providers (Onfido, LexisNexis, etc.) and handle regulatory updates. Building KYC/AML internally requires continuous regulatory monitoring that is expensive to maintain.

    • Point solution per requirement (separate KYC vendor, separate AML vendor) — best-of-breed, integration complexity
    • Unified platform (Alloy, Unit21) — orchestration layer, single integration, covers multiple requirements
    • Build internally — maximum control, significant compliance expertise required
    • Banking partner handles compliance — fastest, constrained to partner's risk appetite
  • Real-time vs batch processing?

    Impact: Real-time ledger balance updates with batch settlement is the correct architecture — matches user expectation (immediate balance update) with payment rail reality (ACH settles T+1). Real-time payment rails (RTP, SEPA Instant) can reduce settlement delay where available.

    • Real-time for all transactions — user expectation, technically complex, higher infrastructure cost
    • Batch for settlement, real-time for authorisation — matches payment rail reality
    • Real-time ledger updates, batch settlement — best UX, reconciliation complexity
    • Full batch — cheapest, poor UX, not competitive

What PROPELOO builds.

  • Consumer Neobank

    Current account, debit card, domestic payments, savings pots, spending analytics and mobile app — built on BaaS partner infrastructure with custom product layer.

  • Business Banking Platform

    SME banking with multi-user access, team spending controls, invoice-linked payments, batch payment uploads, API banking for accounting software and SWIFT for international payments.

  • Remittance Platform

    Cross-border payment platform with multi-currency accounts, competitive FX rates, SWIFT and local payment rail integration, and compliance for money transfer business licensing.

  • Crypto-friendly Bank

    Traditional banking with crypto on/off ramp — fiat account, crypto custody integration, stablecoin support, blockchain transaction monitoring for AML and regulatory reporting.

  • Vertical Neobank

    Industry-specific banking — for gig workers, freelancers, healthcare professionals or students — with product features designed around the specific financial workflows of the target segment.

  • Core Banking Migration

    Migration from legacy core banking system to modern event-sourced architecture — strangler fig migration, data validation, parallel-run reconciliation and zero-downtime cutover.

The neobanking platform stack.

Financial-grade infrastructure with specific tooling per domain.

  • Core Backend

    Stack: Java Spring Boot / Node.js, PostgreSQL (ledger), Kafka (event streaming), Redis (authorisation cache), Temporal (payment workflows)

  • Payment Rails

    Stack: Modern Treasury (payment ops), Dwolla (ACH), Stripe (card + payments), SWIFT Alliance, Open Banking APIs (PSD2)

  • Card Issuance

    Stack: Marqeta, Stripe Issuing, Galileo, Thredd (formerly GPS)

  • Compliance

    Stack: Alloy (KYC/AML orchestration), Sumsub (identity), Sardine (fraud), Chainalysis (crypto AML), ComplyAdvantage (sanctions)

  • Mobile

    Stack: React Native, Expo, Biometric auth, Push notifications (Notifee), Plaid (account linking)

  • Infrastructure

    Stack: AWS (primary), PostgreSQL HA (RDS), HashiCorp Vault, Datadog, PagerDuty

Banking security is a regulatory requirement, not a feature.

Financial institutions are the highest-value targets for attackers and regulators simultaneously.

  • Ledger Integrity

    The ledger must be append-only — no deletions, no balance overwrites. Compensating entries (not corrections) for errors. Hash chaining of ledger events for tamper detection. Separate read replica for customer queries to protect the write path.

  • Payment Fraud Prevention

    Real-time transaction scoring using ML models, velocity limits, device fingerprinting for new payee additions, beneficiary confirmation for large payments, and 24-hour delay on first payment to new payees.

  • Data Encryption

    Account numbers, sort codes, card numbers and PAN data encrypted at field level (not just disk-level). PCI DSS compliance for card data. Key management via HSM (AWS CloudHSM or Thales). Separate encryption keys per customer for data isolation.

  • Access Control

    Bank employee access to customer accounts requires multi-factor authentication, is role-based, time-limited and generates an immutable audit log. No engineer has standing access to production customer data — access requires an approval workflow with business justification.

  • Regulatory Audit Trail

    Every transaction, every KYC check, every AML flag, every customer communication and every employee action on a customer account must be logged immutably with timestamp and actor. Regulatory examinations expect to query this data for any customer, any time range, within hours.

  • Operational Resilience

    PSD2 and UK FCA operational resilience requirements mandate that critical banking services (payment initiation, account balance access) remain available during disruptions. Multi-AZ deployment, RTO/RPO targets per service, tested failover procedures and a Business Continuity Plan are regulatory requirements.

From architecture to regulated banking platform.

  1. 01. Regulatory & Architecture Scoping

    Define regulatory approach (BaaS vs own licence), ledger architecture, payment rails and compliance programme before engineering begins.

  2. 02. Core Ledger

    Event-sourced ledger development, account model, transaction processing, idempotency enforcement and reconciliation framework.

  3. 03. Compliance Infrastructure

    KYC/AML integration, transaction monitoring rules, sanctions screening and regulatory reporting pipeline.

  4. 04. Payment Rails

    Payment rail API integration, routing logic, settlement processing, reconciliation automation and failure handling per rail.

  5. 05. Card Programme

    Card issuer integration, virtual/physical card issuance, authorisation decisioning, spending controls and dispute management.

  6. 06. Mobile Application

    React Native banking app with biometric auth, real-time transaction feed, payment initiation and card management.

  7. 07. Regulatory Readiness

    Compliance audit preparation, regulatory examination documentation, operational resilience testing and launch.

Frequently Asked Questions

Do we need a banking licence to build a neobank?

In most jurisdictions, holding customer funds requires a licence. Options: partner with a licensed institution (BaaS model — Railsr, Unit, Synapse act as the regulated entity), obtain an E-Money Institution licence (EU/UK — 6-18 months, enables payment accounts but not deposit-taking), or obtain a full banking licence (1-3 years, enables loans and deposit insurance). Most neobanks start with a BaaS partner to validate product-market fit, then obtain their own licence as volume justifies the cost.

What is event sourcing and why use it for a ledger?

Event sourcing stores every state change as an immutable event rather than updating state in place. For a ledger: instead of "update balance = $500," you store "credit $100 at timestamp T, debit $50 at timestamp T+1, credit $450 at timestamp T+2." The balance is derived from replaying events. Benefits: complete audit trail (required by regulators), ability to rebuild any past state, reconciliation from first principles, and error correction via compensating entries rather than data mutation. The tradeoff is query complexity for current state — typically solved with a read model that materialises current balances.

What is PSD2 and does it affect our platform?

PSD2 (Payment Services Directive 2) is EU regulation that requires banks to provide API access to account information and payment initiation for licensed third parties (Open Banking). If you are a licensed payment institution operating in the EU, you are required to maintain an API that third-party providers can use to initiate payments from customer accounts (with consent) and access account information. PSD2 compliance requires a dedicated developer portal, production sandbox, and API that meets the RTS (Regulatory Technical Standards) specifications.

How do you handle multi-currency accounts?

Multi-currency requires currency-specific ledger accounts (one account per currency per customer), FX conversion engine with rate source (Reuters, ECB, proprietary spread), settlement in the correct currency via appropriate rail (SEPA for EUR, ACH for USD, SWIFT for others), and currency risk management if you are taking FX risk between customer transaction and settlement. FX spread revenue model requires regulatory approval as a financial product in most jurisdictions.

What does AML transaction monitoring require technically?

AML transaction monitoring requires: a rule engine that evaluates every transaction against configurable rules (structuring detection — multiple transactions just below reporting threshold, velocity rules, geographic risk scoring), case management system for flagged transactions, workflow for analyst review and disposition, SAR (Suspicious Activity Report) filing infrastructure, and audit trail that shows every rule evaluation. Commercial platforms (Unit21, ComplyAdvantage) provide this. Building internally requires ongoing regulatory updates as FATF guidance evolves.