Fintech App Development: PCI DSS, Licensing & Cost Guide

TL;DR

• Ask a developer what your fintech app will cost and you’ll get a number. It’s usually about half of what you’ll really spend.
• PCI DSS stopped being tomorrow’s problem in March 2025. All 51 rules that used to be optional now count in every audit.
• Rough build costs: $60k to $120k for a simple app, $120k to $250k for something bigger, and $250k and up for lending or trading.
• Licensing is what breaks budgets. Bonds run from $10,000 in Wyoming to $7 million in California. Going nationwide often costs more than $1 million.
• Hardly anyone licenses in all 50 states at the start. Most borrow a partner bank’s licenses and give up some margin instead.
• Keeping card numbers off your own servers is the cheapest choice you’ll ever make. You have to make it before you build, not after.

Ask ten founders what their fintech app will cost. Nine will quote you a number from their developer, and that number is usually about half of what they’ll actually spend.

The developer didn’t lowball them. The quote covers software. But a fintech app is software plus a bond, plus a yearly audit, plus an anti-money-laundering program, plus however long a state banking office takes to read your paperwork. None of that shows up in a dev quote, because none of it is code.

So here’s the version I wish more people read first. What the rules cost, what licensing does to your runway, and where the money really goes.

Why fintech costs more than it looks like it should

On a scoping call, a payments app and a food delivery app can look almost the same. Same screens. Same login. Same push alerts. The delivery app ships for a third of the price.

The difference is underneath. Every action in a fintech app has to leave a record you can defend later. Anyone touching card data needs two-factor login. Your error tracker can’t quietly ship a card number into some third-party dashboard. Your tests have to cover the payments that fail, not just the ones that work, because a failed transfer isn’t a bug report. It’s somebody’s rent.

None of that looks like a feature. All of it costs hours.

PCI DSS: the deadline a lot of teams missed

If card data passes through anything you own, PCI DSS applies to you. There’s no clever way around that.

Here’s what many teams still don’t know. Version 4.0 of the standard added 64 new rules. Thirteen applied right away. The other 51 were marked as future-dated and given until March 31, 2025.

That date has passed. Those 51 rules now count like every other rule in an audit. There’s no extension coming, and v4.0.1 is the only live version left.

So if you passed an audit in 2024 and treated the future-dated items as a list for later, later showed up.

Your tier decides your bill

There are four merchant levels, sorted by how many card transactions you run in a year. Level 1 is the expensive one. You need a formal report signed off by a Qualified Security Assessor, or QSA. Everyone else usually fills out a self-assessment form and runs quarterly scans.

The gap is big. Self-assessment plus scans runs about $2,000 to $15,000 a year. Once a QSA is involved, you’re looking at $30,000 to $70,000 a year. Penetration testing is separate and adds another $10,000 to $30,000, depending on how much you’ve built.

Two rules fail more often than the rest

Rule 6.4.3 says you have to know and approve every script running on your payment page. Rule 11.6.1 says you have to notice when that page changes.

Both exist because of a kind of attack where nobody breaks into your server at all. They just slip a script onto your checkout page and read card numbers as they go by.

Teams don’t fail these on tech. They fail on ownership. Nobody can produce the list of scripts, or nobody is watching the alert when the page changes.

Rule 8.4.2 is another common miss. Two-factor login now applies to every account that reaches card data, not just admins and remote workers. Internal tools get caught by this all the time.

And if you think a fully outsourced checkout gets you off the hook, read closer. In January 2025, the council pulled 6.4.3 and 11.6.1 out of the simplest self-assessment form. But they added a new condition in their place. You have to confirm your site can’t be hit by script attacks, either by handling it yourself or by getting that in writing from your payment processor. The paperwork changed. What you owe didn’t.

The PCI Security Standards Council posts the real guidance on this. Read it there instead of trusting a vendor’s summary.

Keep card numbers out of your building

This is the choice that saves the most money over three years, and you only get one shot at it.

Every system that touches card data gets audited. So touch as little as you can. Use hosted payment fields or an iframe from Stripe, Adyen, or Braintree, so raw card numbers never land on your servers. Swap stored cards for tokens, so a leak gives away nothing useful. Split your network so your normal app servers don’t get dragged into the audit alongside the payment path. And check what your monitoring tools record, because those agents log things nobody asked them to.

Do this before you build, and a Level 1 audit gets much smaller. Do it after launch and you pay for the same work twice.

Money transmitter licensing, and the number that scares people

If your product sends, receives, or holds money for someone else, you’re probably a money transmitter. That covers peer-to-peer transfers, remittance, wallets that hold a balance, most crypto on-ramps, and plenty of payroll and marketplace apps that sit on funds for a day or two.

Signing up with FinCEN at the federal level is the easy part. State licensing is where budgets die, because you need a license wherever your customers live. Serve the whole country and you need one almost everywhere, each with its own fee, its own bond, and its own cash requirement.

You don’t hand over the full bond amount. You pay a yearly premium of about 1% to 5% of it, depending on your credit.

Timelines swing hard by state. Texas can clear in three to six months. California takes twelve to eighteen. That’s a big reason so many startups skip California at launch.

What most people actually do

Almost no early-stage fintech licenses nationwide, and honestly, almost none should. The normal path is to partner with a sponsor bank or a Banking-as-a-Service provider that already holds the licenses, then work as their agent.

You launch faster and spend a lot less. In return, you give up margin, you have less control over your own ledger, and your partner’s problems with regulators become your problems too. Several of these providers have taken hard enforcement actions in the last couple of years, and their customers felt all of it.

Go in with your eyes open. Prove your volume first, then buy licenses in the states where the revenue justifies it.

Whatever you decide, check it against current FinCEN guidance and with a lawyer who does this work specifically. How your money moves matters more than what you call your product.

So what does a fintech app cost

Rough bands, based on what teams paid in 2026.

A simple app doing one job well, like a wallet or a peer-to-peer transfer with ID checks and one payment rail, runs $60,000 to $120,000. Add card issuing, spending categories, an admin dashboard, and both iPhone and Android, and you’re at $120,000 to $250,000. Once you’re doing lending, trading, or multi-currency with your own ledger and fraud checks, plan on $250,000 to $500,000 and up.

Engineering eats 45% to 55% of that. Security and compliance take 15% to 25%, and that’s the slice people cut first and regret later. Design is 10% to 15%, and in fintech design isn’t decoration. It’s whether a stranger trusts you enough to connect their bank account. Testing takes another 10% to 15%, because payment edge cases need far more coverage than a normal app. Project management takes what’s left.

Hourly rates move the total as much as scope does. North American teams charge $100 to $200 an hour. Eastern Europe runs $45 to $80. South Asia runs $25 to $50. A good offshore or mixed team can cut the total by 40% to 60%, but only if they’ve shipped regulated products before. This is a bad category to learn on.

The bills that show up later

ID verification costs $0.50 to $3.00 per check. That’s nothing until you’re onboarding thousands a month. Cloud hosting lands between $2,000 and $15,000 a month at scale. Your first SOC 2 Type II report costs $30,000 to $60,000, and enterprise clients will ask for it.

The one that surprises people is upkeep. Budget 15% to 20% of your build cost every year just to stay where you are. On a $200,000 app, that’s $30,000 to $40,000 a year before you add a single feature.

Five things that actually cut the bill

Start licensing before you start building. It takes longer; it runs alongside the dev work, and getting the order right is the difference between launching in month eight and month sixteen.

Buy the boring parts. ID checks, fraud scoring, and card issuing are solved problems. Build the thing that makes you different and plug in the rest.

Use one codebase for both phones if your product allows it. Flutter or React Native frees up money; the compliance side is going to need it anyway.

Launch in one or two states. Prove the model before you buy fifty bonds.

Design for a smaller audit on day one. It’s the only item here that gets more expensive the longer you wait.

Wrapping up

Teams don’t get burned on fintech because they picked the wrong framework. They get burned because they priced the software carefully and everything around it not at all.

Work out your PCI scope before you lock the architecture. Find out the money transmitter license cost in the states you actually care about before you pick a launch market. And plan for the audits, the bonds, and the upkeep, because those bills keep coming long after the app is live.

We build secure mobile apps and web platforms for teams working under real rules. If you’re pricing a fintech product and want an honest breakdown instead of a hopeful one, talk to us.