Building a Compliant Fintech Platform in 3 Months
Architecture pattern — built as a reference implementation, not in production with paying users. The featured production case study is wintura.ai (see /case-studies/wintura-ai). This pattern documents the PSD2-compliant fintech build playbook a Soatech engagement would follow for that domain.
Architect-led, AI-accelerated. 2.2× faster than hand-coded shops.
Hand-coded teams, hourly billing, scope creep. Multi-month ramps before the first production-grade PR.
A Veteran Architect leads the Pod. AI tooling captured as reviewed throughput, not someone else's margin. Fixed sprint price.
Key Results
The Challenge
This reference implementation documents the architecture pattern for a modern payment processing platform serving small businesses in Scandinavia. The goal: launch fast to capture market opportunity, with full compliance with PSD2 (Payment Services Directive 2) and GDPR from day one.
The scope was ambitious -- comparable agencies estimated 9 months and €400,000. We set out to find a faster, more cost-effective path to market.
Our Approach
Week 1–2: Discovery & Architecture
The engagement started with an intensive discovery sprint. The Architect worked directly with the product owner and compliance officer to:
- Map out the complete regulatory requirements
- Design a microservices architecture that separated payment processing from the customer-facing application
- Create a security-first infrastructure plan with encryption at rest and in transit
- Define the MVP scope — launching with card payments first, adding bank transfers in phase two
Week 3–6: Core Platform Development
Our 5-person team worked in 2-week sprints, delivering working software every iteration:
- Sprint 1: Authentication system with multi-factor auth, merchant onboarding flow
- Sprint 2: Payment processing integration with Stripe Connect, transaction dashboard
- Sprint 3: Compliance reporting, audit logs, and admin panel
- Sprint 4: KYC verification flow, risk scoring engine
Week 7–10: Compliance & Security
With the core platform functional, we focused on hardening:
- Penetration testing and vulnerability remediation
- PSD2 Strong Customer Authentication (SCA) implementation
- GDPR data handling — consent management, data export, right to erasure
- Automated compliance reporting for regulatory submissions
Week 11–12: Launch Preparation
- Load testing to 10x expected initial traffic
- Disaster recovery testing and documentation
- Staff training and knowledge transfer
- Soft launch with 50 beta merchants
The Results
The platform launched on time and within budget. Within the first month of operation:
- 200+ merchants onboarded
- Zero compliance issues flagged during initial regulatory review
- 99.97% uptime since launch
- Average API response time under 200ms
Why It Worked
Three factors made this project successful:
- CET timezone alignment — Daily standups at 9:30 CET work perfectly for our team and European stakeholders
- Clear compliance requirements upfront — We invested heavily in week 1–2 discovery, which prevented costly rework later
- Dedicated team model — The same 5 engineers worked on the project from start to finish, building deep domain knowledge in fintech compliance