How to Architect a FinTech Mobile Wallet App in Bangladesh

Building an e-commerce app requires good design. Building a FinTech application requires a flawless obsession with mathematics, cybersecurity, and national regulatory compliance.

The success of bKash and Nagad has sparked a massive wave of innovation in Bangladesh's financial sector. Today, Banks, Non-Banking Financial Institutions (NBFIs), and well-funded startups are racing to build digital wallets, micro-lending platforms, and neo-banks.

However, a financial Mobile App is not a standard software project. A single database rollback error or an unpatched API vulnerability will not just result in a bad user review—it will result in millions of Taka stolen and immediate intervention from the Central Bank.

As a Tier-1 Enterprise Software Architecture firm, BengalTech Engineers have deep expertise in building financial systems. This is our masterclass on architecting a FinTech application in Bangladesh.

Table of Contents

• Bangladesh Bank Guidelines (PSO & PSP)
• e-KYC Integration: The Porichoy API
• Core Architecture: The Immutable Double-Entry Ledger
• Cybersecurity: JWT, Encryption, & PCI-DSS
• The FinTech Technology Stack

Bangladesh Bank Guidelines (PSO & PSP)

Before you write a single line of code, you must understand the regulatory landscape set by the Payment Systems Department (PSD) of Bangladesh Bank (BB).

To launch a digital wallet or payment gateway, you generally need a PSP (Payment Service Provider) or PSO (Payment System Operator) license. Obtaining this license requires passing a brutal technical audit. BB IT auditors will demand to see your:

• Data Localization Architecture: Your primary databases must physically reside within the geographical borders of Bangladesh (e.g., using a local Data Center) or meet strict offshore cloud compliance guidelines.
• Disaster Recovery (DR) Plan: You must prove that if your primary server room catches fire, a secondary failover server (often located in a different city, like Jessore or Chittagong) will take over within seconds with zero data loss.
• Fraud Monitoring: Your backend must include a Velocity Rules engine (e.g., automatically freezing an account if it attempts 5 transfers in 1 minute).

e-KYC Integration: The Porichoy API

Five years ago, opening a mobile banking account in Bangladesh required filling out a paper form and submitting a physical photocopy of your NID (National ID) card. Today, it is done instantly via e-KYC (Electronic Know Your Customer).

To build a modern FinTech app, you must integrate with the Porichoy API (the gateway to the Bangladesh Election Commission's NID database). The technical flow looks like this:

1. The user opens your React Native App and scans their physical NID card using the camera.
2. The app uses OCR (Optical Character Recognition) to extract the 10-digit NID number and Date of Birth.
3. The app asks the user to blink at the selfie camera (Liveness Detection).
4. Your backend sends the NID number and the selfie image to the Porichoy API.
5. Porichoy compares the selfie against the government database and returns a match percentage in seconds.

Core Architecture: The Immutable Double-Entry Ledger

This is where amateur developers destroy FinTech startups.

If User A sends 500 BDT to User B, an amateur developer will write a SQL query like this: UPDATE users SET balance = balance - 500 WHERE id = A; UPDATE users SET balance = balance + 500 WHERE id = B;

This is catastrophic. What happens if the server crashes exactly between those two queries? User A loses 500 BDT, but User B never receives it. The money vanishes into the digital ether.

Financial software must use an Immutable Double-Entry Ledger.

• Balances are never "updated." They are calculated dynamically.
• Every transfer creates two unchangeable records (rows) in a `transactions` table inside a strict Database Transaction Block (ACID compliance).
• If any part of the transaction fails, the entire block is rolled back instantly. The database is never left in an inconsistent state.

Cybersecurity: JWT, Encryption, & PCI-DSS

Your FinTech API will be attacked daily. Your Backend Architecture must be impenetrable.

• Token Security: Never use long-lived API tokens. Use JWT (JSON Web Tokens) with a lifespan of 15 minutes, paired with strict Refresh Token rotation stored in secure HttpOnly cookies.
• Payload Encryption: When the mobile app sends sensitive data (like a PIN code) to the server, do not rely solely on HTTPS/SSL. You must implement asymmetric payload encryption (e.g., RSA AES-256) at the application layer.
• PCI-DSS: If your app processes debit/credit cards directly (not via a third-party gateway window), your entire server architecture must pass rigorous PCI-DSS compliance audits, requiring hardware firewalls and strict access control lists (ACL).

The FinTech Technology Stack

To handle the concurrency of thousands of transactions per second (TPS) while maintaining extreme security, we recommend:

If your financial institution or funded startup is ready to build a massively scalable, deeply secure FinTech platform in Bangladesh, you need an engineering partner that understands the stakes. Contact BengalTech Solutions to discuss your Enterprise Architecture.