Fintech app design services for wallets, investing and money products

The EU technical standard asks for two or more elements out of knowledge, possession and inherence, and for dynamic linking: the payer "is made aware of the amount of the payment transaction and of the payee". It caps consecutive failed attempts at five before a block, and online sessions at 5 minutes without activity. So the approve screen shows the amount and payee, an error never says which factor was wrong, and people are warned before a lockout or a timeout.

The PCI Security Standards Council describes PCI DSS as "a baseline of technical and operational requirements designed to protect payment account data", for every business that stores, processes or transmits cardholder data. The cheapest design decision is to keep card numbers off your servers: card entry sits in your payment provider's hosted fields, saved cards show only the last four digits, and no screen, log or support tool ever displays a full number.

The FATF Recommendations set the international standard behind every country's customer due diligence rules. Its Guidance on Digital ID (March 2020) helps firms decide whether a digital ID is reliable enough for those checks, and notes it can give people without traditional identification a way into financial services. In design terms: ask only what your provider and regulator need, offer national digital IDs such as UAE Pass where they exist, and never end a failed check in a dead end.

PRIN 2A.5.3 says a firm's communications must be "likely to be understood by retail customers" and must equip them to make decisions that are effective, timely and properly informed. PRIN 2A.5.10 adds testing before release, where appropriate, and monitoring afterwards. So the fee screen, the risk warning and the cancel flow get tested for understanding, and the evidence is kept. I do this for teams who hire a fintech product designer in London.

The Directive covers consumer banking services provided after 28 June 2025. Its annex asks that identification, electronic signatures, security and payment services be "perceivable, operable, understandable and robust", and that information not exceed level B2 of the Common European Framework of Reference for Languages. Microenterprises providing services are exempt. I design to WCAG 2.2 AA and write money copy in plain words. My guide to the European Accessibility Act goes further.

MAS's E-Payments User Protection Guidelines, last revised on 25 October 2024, ask for an onscreen chance to confirm the account debited, the amount and the recipient's credentials, with a warning to check, before any payment runs. They also ask for real-time alerts on outgoing payments, a prominent "kill switch" in the app to block access, and a cooling off period of at least 12 hours for high-risk actions on a new device. More on my Singapore product design page.