Published
8 MIN READ
Fintech app development: what the Central Bank and app stores require
Fintech app development goes through three approvals before it reaches the customer: the store's, which requires the app to be published by the company that provides the financial service; the Central Bank's, which regulates how the software is built and tested; and the user's own, who has to be identified before moving money.
Among the ten Brazilian pages I read in September 2026 for this term, none cites the App Store and Google Play rules for financial apps, and none mentions the December 2025 change to the cybersecurity rule for payment institutions.
At Wama, this is a delivered-project topic: in 2025 the studio designed and developed the app for Cappta, a payment institution that offers payment capture and a digital account in a white-label model. This article is the app slice of the complete guide to fintech websites.
What changes in fintech app development?
What changes is who answers for what the app does. In a fintech app, the institution answers to the Central Bank for the software it put in the user's pocket, including the part a third party wrote. The contract with whoever builds it needs to reflect that from the proposal on.
The release pace changes too. Each new version is an event the institution needs to control within the method for building and maintaining a digital product, because a flaw in an update exposes real people's balances, documents and passwords. A clear flow and the moments that decide whether the user stays still apply, only inside a regulated perimeter.
Who publishes a financial app in the stores?
The company that provides the service, not the agency. The App Store Review Guidelines, in rule 5.1.1(ix), state that apps in highly regulated fields, with banking and financial services named explicitly, must be submitted by the legal entity that provides the services, not by an individual developer.
Rule 3.2.1(viii) goes further for investment, trading or money management apps: they must be submitted by the financial institution that provides the service, with the necessary licenses in the places where they're offered. On Android, the Google Play financial services policy makes the financial features declaration in Play Console mandatory for any app with financial functionality.
The developer account belongs to the fintech
The store account is created in the fintech's name, and the vendor joins as an invited member. An app published on the agency's account is an app the fintech doesn't control and that the store can reject. The same goes for the repository, the cloud and the certificates, covered in who keeps the app's code and accounts.
At Wama, that's the rule for everything the studio delivers: the project goes to the client's account, and whoever decides to switch vendors takes everything, because it's already in their name.
What does the Central Bank require of whoever builds the app?
It requires secure development, including when the developer is a third party. BCB Resolution No. 85, from 2021, the cybersecurity policy for payment institutions, was rewritten by BCB Resolution No. 538, of December 18, 2025, with a compliance deadline of March 1, 2026 for those already operating.
The text now lists minimum controls, such as authentication, encryption, intrusion detection, traceability, vulnerability remediation and security in integrations. Art. 3, § 3, says they apply to systems development. And § 6 requires the institution to verify, where applicable, the systems developed by third-party service providers. The studio that writes the app becomes something the fintech has to check and document.
Three requirements that go into the schedule
§ 7 calls for end-to-end audit trails, with logs and secure retention. Art. 22-A requires a penetration test at least once a year, carried out independently by a hired specialist, with documented fixes. And art. 12, § 3, calls for controls against vulnerabilities when releasing new versions of the app. Since the rule was adjusted again in March 2026, confirm with compliance which version applies to your type of institution.
Customer onboarding and identification
The app's sign-up flow is where the know-your-customer rule becomes a screen. BCB Circular No. 3,978, from 2020, in art. 16, requires procedures that verify and validate the customer's identity, including by cross-checking with public and private databases. Art. 18 adds assessing financial capacity, such as income or revenue.
The order of decisions matters: first compliance defines what to collect and validate, then design works out how to ask for it. Reversed, that order produces screens the legal team sends back to be redone. Once sign-up is approved, the path to the first useful action decides whether an opened account becomes a used account.
What the app needs to show the user
Its status as a payment institution. BCB Resolution No. 80, from 2021, art. 5, § 4, II, requires that status to be stated clearly in communication and customer service channels. For most users, the app is the main customer service channel. The website requirements are in what the rule asks of the institution's website.
Not every fintech is an authorized institution: many operate under a partner's license, in white label. In that case, the authorized institution is the one accountable. In Wama's reading, that makes it likely the partner will ask the app for evidence similar to what it would ask of its own team.
How to choose who will build a fintech app
Choose someone who accepts being verified: working within the client's security policy, delivering everything in the client's account and documenting what they did. The table sums up what to ask for in writing.
What to ask the vendor for | Why | Basis |
|---|---|---|
Store, cloud and repository accounts in the fintech's name | The store requires the company that provides the service | Apple 5.1.1(ix) and 3.2.1(viii) |
Secure development practice accepted by the client's policy | The institution verifies what third parties develop | BCB Res. 85, art. 3, §§ 3 and 6 |
Logs and audit trails designed with the product | End-to-end traceability | BCB Res. 85, art. 3, § 7 |
Review before each published version | Vulnerability control in new versions | BCB Res. 85, art. 12, § 3 |
A window in the schedule for the penetration test | Annual, independent test | BCB Res. 85, art. 22-A |
Sign-up validated by compliance before design | Customer identification and qualification | BCB Circular 3,978, arts. 16 and 18 |
Also ask who is responsible for the project day to day. At Wama, a single person leads from brief to delivery, and the AI used for code and automation goes through human review before it reaches the client. In an auditable project, knowing who wrote and who reviewed each part is half the documentation. The other contract points are in what to require in writing from whoever builds it.
How much does a fintech app cost and how long does it take?
It depends on the product and on what comes ready-made from the partner institution. A guide from a Brazilian software house, from March 2026, estimates a digital wallet MVP at between US$ 30,000 and US$ 60,000 and 5 to 8 months. A Brazilian developer, in April 2025, talks about US$ 60,000 to US$ 300,000 and 4 to 12 months.
Wama's general range for SaaS and custom software goes from US$ 4,000 to US$ 20,000, reaching US$ 40,000 depending on complexity, with 50% upfront and 50% on delivery. That's a digital product benchmark, not a regulated app one: the penetration test, identity integrations and release review come on top. See what drives the price of a first version.
Common mistakes in fintech app development
Publishing on the agency's account. The store may reject it, and the fintech loses control of the product.
Designing sign-up before compliance. The screens go back to square one when the data list changes.
Treating security as a final phase. The rule calls for controls during development, not a report at the end.
Leaving the penetration test out of the schedule. It's annual, independent and generates fixes.
Frequently asked questions
Can an agency publish the fintech's app on its own account?
It's not the safe route. Apple requires financial services apps to be submitted by the legal entity that provides the service, and Google Play requires the financial features declaration. The right way is for the account to be created in the fintech's name, with the agency invited as a member to publish and maintain the app.
Does BCB Resolution 85 apply to every fintech?
It applies to authorized payment institutions and also to brokers and dealers. A fintech operating under a partner's license isn't the direct target, but the partner answers for what runs on its infrastructure and tends to require equivalent controls. Confirm your classification with compliance.
What changed with BCB Resolution 538?
Published in December 2025, it detailed the minimum cybersecurity controls, extended those controls to systems development, including systems built by third parties, required end-to-end audit trails and made an independent penetration test mandatory at least once a year.
Does the app need to say the company is a payment institution?
Yes, when it is an authorized payment institution. BCB Resolution 80 requires that status to be stated clearly in communication and customer service channels. Since the app is usually the main customer service channel, the information needs to be in a fixed, easy-to-find place.
How long does it take to develop a fintech app?
Market guides published between 2025 and 2026 talk about 4 to 12 months, with a digital wallet MVP estimated at 5 to 8 months. The timeline grows with the number of integrations, with compliance validating the sign-up flow and with the penetration test window before launch.
If your fintech is about to get an app off the ground and wants the scope, the accounts and the release process defined before the first screen, talk to Wama and ask for a detailed proposal.
