Fintech segments we test

Consumer fintech

Consumer products hold or move customer money, so revenue is taken inside each transaction: card interchange, FX margin, instalment and late fees, interest, and AUM fees. A defect in these flows charges the wrong amount to many customers in the same batch, and the fix is a refund run plus an explanation to the regulator or partner bank.

• FX margin applied twice. The quote service and the ledger both add the margin, so the sender pays more than the disclosed amount. For US remittance transfers, Regulation E requires the exchange rate, fees, and "Total to Recipient" to be disclosed before payment (12 CFR 1005.31). An incorrect amount paid by the sender is an error under 12 CFR 1005.33(a)(1), and for each transfer the sender reports within 180 days of the disclosed date of availability, the provider must correct the error by the remedy the sender chooses under 1005.33(c)(2): a refund, or making the funds available to the recipient at no extra cost. See international transfers.
• Late fee posted before the repayment. The fee job runs before the repayment file is applied, so customers who paid on time are charged a late fee. Each fee becomes a refund and a complaint record.
• Interest accrued on the wrong day count. The accrual engine uses a different day-count convention from the loan agreement, so every balance drifts. Borrowers are charged interest that differs from the loan agreement, and each overcharge becomes a refund and a correction to the borrower's account history. See consumer lending.

B2B finance SaaS

B2B products earn per seat, per employee, as a take rate on processed payments, or as a percentage of the customer's revenue. A defect here lands in the customer's books: a wrong invoice or payment run is copied into their accounting and tax filings before anyone sees it.

• Proration at the new price. A mid-cycle upgrade credits unused time at the new plan price instead of the old one, so every upgrade is billed wrong and the revenue recognition schedule no longer matches the invoices. See subscription billing.
• Duplicate payment run after a timeout. The AP platform retries a bank file submission, the bank accepts both files, and suppliers are paid twice. Under the Nacha Operating Rules the originator or its bank (ODFI) must get the reversal of a duplicate to the receiving bank within five banking days after the settlement date (Nacha, reversals). A reversal sent inside that window can still be returned if the supplier's account no longer holds the funds (Nacha, 2026-08-06), and recovery then depends on each supplier.
• Withholding tables not updated for the tax year. A pay run uses last year's federal withholding tables and withholds too little from employees whose brackets changed. Under 26 U.S.C. 3403 the employer is liable for the tax it was required to withhold, so the payroll platform's customer carries the shortfall and files corrections.

Infrastructure and regtech

Infrastructure earns a take rate per transaction, a fee per API call or connection, a fee per check, or a share of chargebacks won. A defect here repeats for every merchant or card programme built on the platform, so one release can create the same loss across many downstream ledgers.

• Non-idempotent capture. A retried capture request without an idempotency key captures the payment twice. The cardholder disputes the second charge, and the merchant pays the refund plus the chargeback fee. See payment acquiring.
• Lost webhook between issuer processor and programme ledger. A dropped authorisation or settlement event leaves the programme balance different from the sponsor bank's end-of-day file, and the gap shows up in the bank's reconciliation review.
• Dispute evidence sent after the network deadline. The evidence job queues past the card network's response window, the dispute is lost automatically, and a vendor paid a share of chargebacks won earns nothing on it.

Licence flags and the evidence they add

Every chip on the map carries one of three labels. The label decides whether test scope includes regulated flows and who will read the evidence.

Licence required. The product moves or holds money, lends, or provides investment services under its own licence or through a partner bank, or it sells insurance as a carrier or through an MGA. Regulated flows are tested against the requirement text, and the output is an evidence pack: test cases traced to requirements, execution logs, and dated defect records. In the EU, strong customer authentication is tested across payment and account access paths (PSD2 and SCA). In the US, state money transmitter examiners and partner banks ask for evidence on disclosures, error resolution, and transaction monitoring (GLBA and money transmitter requirements). In Canada, payment service providers register with the Bank of Canada and, since 8 September 2025, must have risk management and funds safeguarding frameworks in place (RPAA, Bank of Canada).

Licence for some flows. Most of the product is software, but some flows fall under a licence held by the company or a partner: fund movement in AP payment runs, contractor disbursement in payroll, or data access in open banking. We scope those flows separately, so regulated evidence covers them and the rest is tested as software.

Software only. The product does not hold or move customer funds. Test scope centres on calculation accuracy and integration behaviour, and the evidence answers the security and vendor reviews your enterprise buyers send.

Regulatory sources on this page were checked on 2026-09-16.