Neobank and digital banking app testing
FintechAssuranceLabs tests neobank and digital banking apps, the category of products like Revolut, Nubank, Chime, and Monzo. Test scope covers card issuing and authorisation, KYC onboarding, ledger integrity, FX conversion, premium plan entitlements, and strong customer authentication. FintechAssuranceLabs engineers have tested these flows for neobanks and hand over test evidence that a partner bank or supervisor can review.
What breaks in neobank money flows
A neobank earns on card spend (interchange), premium plan fees, currency conversion, and lending. Each defect below hits one of those flows and repeats for every customer on the same code path.
- Contactless counter reset at midnight. The issuer resets the cumulative contactless amount each day instead of at the last strong customer authentication. RTS (EU) 2018/389 Article 11 allows the contactless exemption only while payments since the last SCA stay at or below EUR 150 in total, or number five or fewer (Delegated Regulation (EU) 2018/389, checked on 2026-09-16). A stolen card then passes days of small payments without SCA. Under PSD2 Article 74(2), the payer bears no loss when the provider did not require SCA, unless the payer acted fraudulently, so the issuer carries the fraud loss on payments that earned it only interchange. Test cases are on the PSD2 SCA page.
- FX markup charged against a different rate than the one disclosed. The app discloses a markup over the ECB reference rate, but the ledger applies the markup to the card scheme's clearing rate plus a weekend surcharge. Regulation (EU) 2021/1230 Article 4(1) requires the total currency conversion charge on card payments in Union currencies to be expressed as a percentage markup over the latest ECB euro reference rate and disclosed before the payment (Regulation (EU) 2021/1230, checked on 2026-09-16). The FX margin on each affected payment becomes a refund of the difference, and the mismatch is a breach of Article 4(1) that the national competent authority can act on. The FX rate application guide shows the recalculation.
- Card usable before customer due diligence completes. The card service issues a virtual card and accepts a top-up on the account-created event, while the identity check still waits for the vendor's webhook. Directive (EU) 2015/849 Article 14(3) lets Member States allow account opening before verification only with adequate safeguards that stop transactions until due diligence is complete. The first spend earns interchange on an unverified customer, and the transaction can become a supervisory finding against the licence holder. See AML and KYC testing requirements.
- Dispute deadline counted from card activation. For US debit cards, Regulation E extends the 10-business-day limits to 20 business days only for transfers within 30 days after the first deposit (12 CFR 1005.11(c)(3)(i)). A dispute system that counts the 30 days from card activation applies the 20-business-day limit to customers whose first deposit was earlier, so their provisional credit can arrive up to 10 business days late. Each late case is a timing violation that the partner bank's examiner can find in the case log. The Regulation E page lists the timers.
- Premium entitlements lost after a recovered renewal. A renewal payment fails, the entitlement service downgrades the account, and the dunning retry succeeds on day three without restoring the plan. The customer pays the plan fee and is still charged foreign ATM and weekend FX fees that the plan covers. Each fee becomes a refund and a complaint, and the plan fee paid for benefits never delivered is a refund claim as well.
Licence flag and the evidence you will need
Neobanks carry the licence flag: a neobank holds a banking or e-money licence, or offers accounts and cards through a licensed partner bank.
United States
A US neobank without a bank charter holds customer deposits at a partner bank. The partner bank oversees that relationship under the 2023 Interagency Guidance on Third-Party Relationships (OCC, Federal Reserve, FDIC). On 15 September 2026, the OCC, Federal Reserve, FDIC, and NCUA published proposed guidance that would rescind and replace it; comments close on 16 November 2026 (checked on 2026-09-16). Partner bank due diligence asks for:
- customer identification test results showing that name, date of birth, address, and identification number are collected before an account opens (31 CFR 1020.220(a)(2)(i), checked on 2026-09-16);
- Regulation E error resolution timer tests per case type, with provisional credit records;
- reconciliation records between the neobank ledger and the partner bank's custodial account.
The partner bank integration scenario sets out the sequence.
European Union
An EU neobank holds a credit institution or e-money institution authorisation and is supervised by its national competent authority. The authority can request the RTS Article 3 audit report on SCA measures and test evidence that those measures were periodically tested. DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 and requires a digital operational resilience testing programme with at least yearly tests of systems that support critical or important functions (Articles 24(1) and 24(6)). Where national law allows account opening under Directive (EU) 2015/849 Article 14(3), onboarding test cases are the evidence that the safeguards stop every transaction until due diligence completes.
Canada
A Canadian neobank that holds end-user funds as a payment service provider registers with the Bank of Canada under the Retail Payment Activities Act. Sections 17 to 22, covering operational risk, incidents, and safeguarding, have been in force since 8 September 2025 (RPAA). The Bank of Canada can request the end-user funds ledger, which records funds held per end user at the end of each day (RPAR 15(2)(b)), and shortfall identification test results under RPAR 16(1).
Neobank test scenarios
- Card lifecycle. Create, activate, freeze, replace, and close a card; an authorisation after freeze declines, and a replacement card keeps spend controls and wallet tokens.
- Hold expiry and late presentment. A clearing record arrives after the authorisation hold is released; the ledger posts it once, and the negative balance path starts.
- Incremental and partial clearing. Hotel and fuel authorisations increase, then clear for a lower amount; the released remainder returns to the available balance.
- Interchange posting. Interchange from the processor or partner bank settlement report matches the ledger per transaction, and refunds reverse it.
- FX conversion. Foreign currency spend converts at authorisation and again at clearing; refunds in the same currency settle at a different rate; the Article 4(5) message goes out once a month per currency.
- KYC states. Pending, approved, rejected, manual review, and resubmission each allow or block card issuing, top-ups, and inbound transfers; a delayed or duplicated vendor webhook changes no decision.
- SCA boundaries. Contactless payments at EUR 50, EUR 150 cumulative, and the sixth consecutive payment; a 3-D Secure challenge on remote payments; device binding on a new phone.
- Plan entitlements. Upgrade, downgrade, failed renewal, and dunning recovery; allowance counters for free ATM withdrawals and FX reset on the billing date.
- Disputes. Regulation E timers per case type, provisional credit, and reversal notices for debit card disputes.
- Lending. Overdraft or credit line interest accrues on the agreed day count, and repayments from salary deposits are allocated in the documented order.
Card issuing and processing testing delivers the card lifecycle suite and the interchange posting checks, and ledger and reconciliation testing delivers the double-entry invariant suite behind the hold, clearing, and refund cases.
Integrations and protocols to cover
- Issuer processor messages. ISO 8583 authorisation, advice, and reversal messages, plus real-time authorisation webhooks with response deadlines and stand-in behaviour when the neobank endpoint times out.
- Scheme clearing files. Daily clearing and settlement files from the card networks, delivered through the processor, reconciled against authorisations.
- Token services. Mobile wallet provisioning and token lifecycle events for freeze, replace, and close.
- 3-D Secure access control server. Challenge flows and out-of-band authentication inside the app.
- KYC vendor APIs. Document and liveness checks, sanctions and PEP screening, and asynchronous result webhooks.
- Account rails. SEPA credit transfers and instant transfers as ISO 20022 pacs.008 with camt.053 and camt.054 statements, and US ACH as Nacha files with return codes.
- Open banking interfaces. PSD2 access interfaces for third-party providers in the EU, and the US developer interface under 12 CFR Part 1033, whose compliance dates a federal court stayed on 29 October 2025 (CFPB, status verified on 2026-09-16).
- Partner bank and billing systems. Partner bank balance APIs and custodial account files, subscription billing events, push notification delivery, and credit decision services.
Related
Standards
- PSD2 and Strong Customer Authentication
- PSD3 and the Payment Services Regulation
- EMV 3-D Secure 2
- EMV chip and contactless
- PCI DSS 4.0
- Digital Operational Resilience Act
- EU AML directives and regulation, KYC obligations
- GDPR for financial data
- Open Banking standards: UK OBIE, Berlin Group
- European Accessibility Act, with WCAG 2.2 and EN 301 549
- Electronic Fund Transfer Act and Regulation E, including the remittance transfer rule
- Truth in Lending Act and Regulation Z
- Equal Credit Opportunity Act and Regulation B
- GLBA and US state money transmitter requirements
- Nacha Operating Rules for ACH
- CFPB personal financial data rights rule (section 1033)
- ISO 20022
- Retail Payment Activities Act
- PCMLTFA and FINTRAC obligations
Services
- Card issuing and processing testing
- Ledger and reconciliation testing
- Payment flow testing
- Bank transfers and payment rails testing
- KYC, AML and fraud testing
- Subscription billing and revenue testing
- Mobile banking and finance app testing
- Open banking API testing
- BaaS and partner bank integration testing
- Security testing
- Data privacy and test data management
- Accessibility testing
- Operational resilience testing
- Data and platform migration testing
- Test automation
- Audit and certification test evidence
- QA audit and test strategy
- Dedicated fintech QA team
Guides
- How to test ledger reconciliation against settlement files and bank statements
- How to test SCA exemptions: low value, TRA, and trusted beneficiaries
- How to test FX markup: rate application and markup disclosure
- How to test 3DS2 challenge flows with 3DS test cards
- How to use test card numbers in payment testing
- How to test webhook delivery from BaaS and payment providers
- How to test Nacha return codes: ACH return entries, time frames, and ledger effects
- How to test Same Day ACH cutoff times and settlement timing across time zones
- How to test the accrued interest formula and day count conventions
- How to test 90-day reauthentication, consent expiry, and token refresh in open banking
Sample deliverable
Sample, synthetic data
| Control or requirement | Test case IDs | Run date | Result | Evidence file | Reviewer role |
|---|---|---|---|---|---|
| PCI DSS v4.0.1 3.3.1: the card verification code is not stored after authorisation | TC-PCI-031, TC-PCI-032, TC-PCI-033, TC-PCI-034 | 2026-09-08 | Passed: 4 of 4 test cases, no card verification code found in databases, logs, or queues | EP-01_pci-3.3.1_data-store-search.csv | Security test lead |
| PCI DSS v4.0.1 3.4.1: a displayed PAN shows at most the BIN and the last four digits | TC-PCI-040, TC-PCI-041, TC-PCI-042 | 2026-09-10 | Passed on retest: 3 of 3 test cases after the fix for defect DEF-118 (full PAN on the support detail view) | EP-02_pci-3.4.1_masking-per-role_retest.pdf | QA lead |
| PCI DSS v4.0.1 6.2.4: the refund API rejects a refund on a payment that another account owns | TC-SEC-210, TC-SEC-211 | 2026-09-09 | Passed: 2 of 2 test cases, each cross-account refund request returned HTTP 404 | EP-03_pci-6.2.4_refund-object-authorisation.pdf | Security test lead |
| SOC 2 CC6.2: sessions and API tokens of a deactivated user are rejected | TC-ACC-015, TC-ACC-016, TC-ACC-017 | 2026-09-09 | Passed: 3 of 3 test cases, each request after deactivation returned HTTP 401 | EP-04_soc2-cc6.2_deprovisioning-log.csv | QA lead |
| SOC 2 CC8.1: every change in the release ran the regression suite before production | RUN-REG-0907, RUN-REG-0910 | 2026-09-10 | Passed: 27 of 27 change tickets link to a green CI run | EP-05_soc2-cc8.1_ci-runs-per-change.csv | Test automation lead |
| PSD2 RTS Article 4(3)(b): access is blocked after five consecutive failed authentication attempts | TC-SCA-007, TC-SCA-008, TC-SCA-009, TC-SCA-010 | 2026-09-10 | Failed: 3 of 4 test cases passed; the app resets the attempt counter on a new session (defect DEF-131, release blocker) | EP-06_rts-art4-3b_lockout-per-channel.pdf | QA lead |
| PSD2 RTS Article 5(1): the payment executes only with the amount and payee shown at authentication | TC-SCA-020, TC-SCA-021, TC-SCA-022 | 2026-09-08 | Passed: 3 of 3 test cases, a changed payee after authentication invalidated the authentication code | EP-07_rts-art5-1_dynamic-linking.csv | Payments QA engineer |
| PSD2 RTS Article 10a: account information access through a third-party provider requires SCA again after 180 days | TC-AIS-004, TC-AIS-005, TC-AIS-006 | 2026-09-09 | Passed: 3 of 3 test cases, access allowed on day 179 and refused on day 181 without a new SCA | EP-08_rts-art10a_access-decisions.csv | Payments QA engineer |
Test case IDs, defect IDs, run dates, and evidence file names belong to a fictional release; PAN checks used scheme test card numbers, and no real account, customer, or person appears.
Questions
What is a neobank?
How do neobanks make money?
How to test banking applications?
Scope your neobank testing
Send your licence or partner bank model, card processor, and release cadence, and we return a test scope with the evidence each regulated flow needs.
Scope your testing