End-to-End Digital Banking Platform for a European EMI
A complete Electronic Money Institution stack—core banking backend, SEPA instant payments with ISO 20022 compliance, sanctions screening, and a biometric-KYC client portal.
The Problem
A licensed European Electronic Money Institution needs an unforgiving combination of capabilities: multi-role account management, regulator-grade KYC with document and biometric verification, SEPA instant payments that settle inside a 10-second window with strict ISO 20022 XML schema compliance, continuous sanctions screening against constantly changing international watchlists, and audit trails behind every action. Fragmented vendor services create integration seams exactly where compliance risk is least affordable.
The technical details are hostile, too. ISO 20022 schemas contain hundreds of interdependent types where hand-written XML risks payment rejection; sanction lists arrive from a dozen authorities in inconsistent XML, JSON, PDF, and HTML formats that change without notice; and accurate SEPA routing depends on tens of thousands of bank BIC codes that exist primarily inside a 6,000-page PDF.
What We Built
We built the platform end to end. A Go core backend with 15 API modules and 26 business logic components orchestrates authentication, accounts, multi-step KYC with Azure Document Intelligence ID parsing, employee roles, fees, and real-time WebSocket notifications. A dedicated transactions service processes SEPA Instant Credit Transfers, recalls, and return-of-funds workflows using Go types generated from the ISO 20022 XSD schemas by our own code generator—making schema compliance a compile-time property instead of a runtime gamble.
Around the core: a Python/Luigi ETL ingests 13+ sanction and watchlist sources (OFAC, EU, UK, Interpol, FATF) into a single screening database serving two purpose-built APIs—a comprehensive tier for compliance workflows and a minimal fast path for latency-sensitive inline checks. A role-based Vue 3 portal covers clients, employees, and admins with AWS face-liveness biometric KYC, and deployment automation ships the whole fleet with zero-downtime rollouts, database migrations, and 45K+ bank BIC reference records extracted from ISO 9362 PDFs.
Core EMI banking backend
15 API modules and 26 business-logic components cover accounts, KYC workflows, compliance, fees, and roles, with Azure Document Intelligence automating ID parsing and WebSocket delivering real-time balance and transaction updates.
Compile-time ISO 20022 compliance
An in-house XSD-to-Go code generator turns payment schemas into type-safe structs with validation and marshaling, so SEPA messages that compile are messages the network accepts.
Dual-tier sanctions screening
One Luigi ETL ingests 13+ international watchlists into a single source of truth feeding both a full-featured compliance API with fuzzy matching and bulk screening, and a two-endpoint fast path for inline transaction checks.
Biometric KYC client portal
A role-based Vue 3 application with multi-step onboarding forms, AWS Amplify face-liveness verification, and automatic token refresh keeps account opening smooth and fraud-resistant.
How It Works in Practice
A new business customer opening an account and sending their first SEPA instant transfer.
- 1
Onboard with biometric KYC
The applicant completes multi-step forms, uploads an ID that Azure Document Intelligence parses automatically, and passes face-liveness verification—no manual data entry, no branch visit.
- 2
Screen continuously
The applicant is checked against 13+ sanction sources at onboarding, and every subsequent transaction hits the fast-path screening API without adding perceptible latency.
- 3
Pay within the instant window
The transfer is assembled as ISO 20022 XML from schema-generated types and processed through the SEPA Instant Credit Transfer flow inside the 10-second settlement window.
- 4
Track everything
WebSocket pushes the status and balance change to the portal in real time, while the audit trail records every state transition for regulators and dispute resolution.
Screenshots
Engineering Approach
Generate what regulators specify
Payment schemas and bank reference data are machine-generated from their authoritative sources—XSD schemas, ISO 9362 PDFs, IANA data—because hand-maintaining regulatory artifacts is where compliance failures are born.
One source of truth, purpose-built consumers
Sanctions data is ingested once and served through two API tiers with different speed/depth trade-offs, instead of duplicating fragile ETL pipelines per consumer.
Failure domains kept apart
A failing watchlist source never affects live screening, and screening never blocks the payment path—each layer serves the last known-good data while its upstream recovers.
Have a similar problem?
Tell us what you're working on and we'll tell you honestly whether we can help.
