The Solution
Co.X carried out an initial business analysis that helped them map out the entire product and its interdependencies. Following this, they decided to build an MVP (minimum viable product) pilot that would demonstrate to the national authorities its integral viability to facilitate high-volume transactions and move money around in crypto and fiat money.
Pivotal to this process and a successful roll out were two service partners that the company was careful to select – one for the frontend and one for the backend. For the frontend systems of payment processing directly with Visa or Mastercard, Co.X worked with SIBS Romania, a European reference that was plugged into the Romanian banking ecosystem. SIBS was tasked with developing Co.X’s highly customized processing platform, as well as managing the card issuing (including 3D Secure) and personalization processes.
For the backend system which was really the core banking system that ran and held the whole business and product operations together, Co.X awarded the project, through an RFP, to Zitec, a bespoke software engineering and digital transformation service provider.
“Although pricing and timeline were part of our selection criteria, ultimately, they were not the differentiators for our choice. We decided on Zitec for their people, their no-nonsense approach and their team’s technical maturity in dealing with a complex high-stakes project.”
Co.X CEO
Zitec, known for their highly flexible and technically versatile teams, also demonstrated proven experience in developing and integrating to fintech regulatory compliance and standards, clinching them the deal. They did not only bring technology and project management know-how, but they also had practical knowledge of PCI-DSS, ISO 27001 and ISO 8583, to name a few.
The Core
The full extent of fintech intricacies is rarely visible or simple. Contrary to what most people expect, transaction speed is not a top criterion. Precision and predictability are. Fintech customers don’t expect to lose money, nor do they expect to approximate money, e.g. no sum is rounded up to the closest decimal point when it comes to an account holder’s money.
The accuracy in moving or manipulating the exact sum that’s needed may sound easy enough to understand. However, when it is translated into moving volumes across a web of digital networks, held up by layers of complex software and cloud computing applications, and integrated into different system languages, the risks multiply. The system is built on purpose to not create a different result even when it receives repetitive signals or actions. This prevents double charging a consumer or duplicating payments to a merchant. In parallel, the system or systems have to be able to handle transaction volumes that might fluctuate and surge under millions of active users within seconds. Any round-the-clock, high-volume, and highly regulated type of online transactions will need to ensure systems resilience for this, and for withstanding downtimes or cybersecurity threats. Zitec worked hand in hand with Co.X to manage the different integrations and build necessary workarounds, particularly in three strategic areas to keep the project on track.
System Integrations, Simulations and Testing
Dealing with novelty required that the Co.X – Zitec team implement with high levels of abstraction, while being flexible enough to pivot with constantly moving targets. The fully automated digital process required business decisions at every turn that impacted multiple layers of interdependencies. They ranged from how many currencies and which, what range and types of transactions, to ways for evaluating or checking user accounts, vetting procedures for onboarding users and what the risk matrix would look like, and so on. It was also necessary to simulate the workings of the frontend systems and app by SIBS that was to be crypto-enabled and be integrated later to formulate a working hypothesis for the core.
Capitalizing on Node.JS’ competency among others, Zitec was able to simulate a high-scale application that could support interoperability from several concurrent requests as though the service was really running. Meeting SIBS’ product specifications, fully aligned with PCI/mc/v standards, tests were carried out against standards like ISO 8583 that looked at electronic transactions exchanges initiated by multiple cardholders using payment cards. Another aspect of testing that Zitec handled was PCI-DSS compliant penetration testing (pen test) for cybersecurity. Co.X broke with the norm and wanted two pen tests, one for Romania and one for the UK to be extra safe. Typically, PCI-DSS compliance requires only one test per year, and not for a newly deployed MVP.
Ensuring Digital Layers Serve the Business
Co.X’s operational expectations was to be able to handle 1.7 million active users and three million card transactions, whereby 99% of them could be served in less than a second. These were met and exceeded to hold up under transaction volumes, back-ups and redundancies, service level speeds, performance uptime and multichannel system resilience. The entire core system was ensured to run on an uptime of over 99.95%, capable of withstanding multiple degrees of machine failures. For example, if the data center that included a Kubernetes cluster went down, the mobile app and payment systems would continue to run. Security aspects such as KYC and AML compliance integration for user onboarding were incorporated and applied to the administrative interface that included essential multi-factor authentication.
Meeting Regulatory Demands
Being the first of its kind in Romania, much of the reporting for regulatory compliance had to be learnt while doing. There were no direct interconnections with the national regulator and all expected reports had to be carried out manually. Additionally, when digital user onboarding happens, the assumption is to share the KYC with other interdependent systems like those of SIBS. In this case, the local regulator stepped in and required that a native KYC protocol be developed in the core system itself for each user onboarding and be incorporated into the reporting. Zitec, in collaboration with SIBS, handled and simplified this by building into the system the ability to generate daily reporting of transactions for communicating to the authorities.
