Services · Mobile app development · Fintech apps
Codeeo handles fintech app development in Riyadh for licensed finance companies, payment providers, brokers, advisory firms and the service businesses that onboard and manage their clients. We build the customer app, the operations dashboard and the integrations behind them, shaped around Saudi identity checks, mada payments and the documentation regulators expect. Part of our team of 80+ works from Riyadh, so workshops with your compliance, risk and product leads happen in person, in the same city as the regulators you report to.
Riyadh is where the Saudi Central Bank and the Capital Market Authority sit, and where most licensing conversations begin. An app built here has to survive a sandbox review, a security assessment and a demanding Arabic speaking customer, often in the same quarter.
200+ companies servedFrom a first store to an ADX listed developer
What we build
Most fintech projects that reach us in Riyadh are not short of ideas. They are short of time between a licence decision and launch, and they need software that a compliance officer can explain line by line. So we start from the controls and build the customer experience on top of them, not the other way round.
Every capability below can be delivered as a native or cross platform app, with a web dashboard for staff. We design Arabic first, with English as a full second language, because a Riyadh customer base spans Saudi nationals, resident professionals and corporate clients who expect both. Integrations are planned with your bank partners and providers early, since their test environments usually set the pace of the whole programme more than our own development does.
Financial services app development in Riyadh also means planning for scale from the first release. Customer numbers can rise quickly after a launch campaign or a payroll partnership, so we size infrastructure, queues and support tooling for that moment rather than for the pilot group.
Customers confirm identity through Nafath, then complete a short KYC flow covering occupation, source of funds and purpose of account. Risk scoring rules set by your compliance team decide whether an application passes, waits for review or stops, and each decision is stored with its reason.
Faster account opening with a defensible record behind every approval.
For digital wallet app development in Riyadh we build the balance view, top ups by mada card or bank transfer, peer transfers and merchant QR payments, with Apple Pay where your issuing partner supports it. The ledger lives on your licensed partner's side; the app presents it clearly and never invents a balance.
Customers trust what they see because it matches the ledger.
Holdings, statements, suitability questionnaires and signed documents in one place for clients of CMA authorised firms. Relationship managers see the same records from the dashboard, so a client call in Olaya starts from the facts.
Fewer emailed PDFs and a cleaner audit trail.
Saved billers, SADAD bill payments, due date reminders and receipts the customer can download. We handle failed and pending states explicitly so nobody pays twice when a network call times out.
Payments that settle once and are easy to reconcile.
Alerts from screening and transaction monitoring land in a queue with owners, due dates and escalation paths. Analysts add notes, request documents from the customer inside the app and close cases with a recorded rationale.
Your AML team works one queue instead of spreadsheets.
For employers headquartered in Riyadh, a module that pays salaries into employee wallets, issues allowances and shows payslips, with approvals by the HR and finance managers before each run. Exceptions such as a rejected IBAN or a new joiner without a verified identity are flagged before money moves.
Payroll runs that fail less and explain themselves when they do.
Account information and payment initiation through providers operating under the SAMA Open Banking Framework, with consent screens that tell the customer exactly what is shared, for how long and how to revoke it.
Richer products without asking customers for bank passwords.
Device binding, biometric login, certificate pinning, session limits and encrypted local storage, mapped to NCA Essential Cybersecurity Controls and the SAMA Cyber Security Framework so your assessor can trace each requirement to a control.
Security review becomes a checklist exercise, not a rebuild.
Where you bill SMEs or corporates for services, invoices are generated in a format ready for ZATCA Fatoora, with VAT lines and QR codes handled by an accredited provider you choose.
Business customers receive invoices they can file without edits.
Role based access for operations, finance, risk and support, with exports shaped for internal committees and regulator requests. Sensitive actions require a second approver, and every change carries a timestamp and a user.
Management sees the business daily, auditors see who did what.
Who this is for
Riyadh concentrates the regulators, the large banks and most of the Kingdom's licensed fintechs, so the firms we meet here tend to be further along than elsewhere. They usually already know their licence category. What they need is a delivery team that understands why a compliance sign off can move a release date, and which features a regulator will question first. These are the four starting points we see most often in the capital, from early stage teams to established groups.
You tested a product inside the SAMA sandbox or under a CMA FinTech experimental permit with a limited group of users. Now the production version must handle real volumes, stronger controls and the conditions attached to your licence. We review the sandbox build, keep what holds up and rebuild what was a prototype, so the move to a full licence does not stall on technical debt.
We also prepare the release notes and test evidence your licensing team needs when it reports progress back to the regulator.
We read your licence conditions before we estimate anything.
Consumer and SME finance firms in Riyadh still run many applications through branches, paper and call centres. We build the application flow, SIMAH consent capture, document upload, contract signing and repayment schedule views, connected to your existing loan management system rather than replacing it on day one.
Early repayment, rescheduling requests and delinquency reminders are written in careful, respectful Arabic, because collections tone matters to customers and to the regulator alike.
Accounting practices, zakat and tax advisers, payroll bureaus and corporate service providers in the King Fahd Road and Olaya business areas need a secure client portal: onboarding, document exchange, approvals and status tracking. These are not licensed fintechs, but their clients expect the same level of care with financial data, and PDPL applies to them just the same.
We keep scope small: secure login, a request tracker, signed approvals and a document vault usually cover most of the need.
This is the most common Riyadh brief we receive.
An established institution sometimes wants a separate app for a new segment, such as a youth account, a corporate card or an employee benefit wallet. We work inside your vendor governance, security review and change management, and we document everything for the team that will own the app internally.
Handover includes architecture notes, runbooks and recorded walkthroughs so your internal engineers can take over without depending on us.
Ways to work with us
A fixed scope first release suits firms with a clear licence category and a defined product. A dedicated team suits institutions running several workstreams at once, with engineers who learn your controls and stay with them. A support retainer covers apps already live, including the steady flow of SAMA circulars, partner API changes and app store policy updates. What drives cost in every model is the number of integrations, the depth of compliance tooling, the number of user roles and the testing your assessor requires. We share a written estimate for each release, with assumptions listed, so changes in scope are visible before they affect the budget.
A defined build with a deadline
We agree what the product has to do, write it down with a price and a date, and build exactly that. Changes are priced before they are made, not discovered on the invoice.
A product that keeps evolving
Named engineers who work your hours, join your standups and stay on the codebase. You direct the backlog; we own the quality of what ships.
Something live that needs looking after
A monthly block of hours for improvements, fixes and the small requests that otherwise wait months. Unused hours carry for a quarter.
Technology
We use Flutter, React Native or native Swift and Kotlin depending on your security requirements, with backends on in Kingdom cloud regions. Your technology choices are made with the team that will maintain the app afterwards. Monitoring, alerting and crash reporting are configured before launch, not after the first incident.
01Mobile
02Data and cloud
03Marketing and tracking
Mapping your licence, controls and partners before design begins.
The code is usually the most predictable part. The real work is agreeing which SAMA or CMA requirements apply, which bank or processor holds funds, where customer data sits, and how each control will be evidenced. We run that mapping with your compliance lead in our Riyadh workshops, so design starts with constraints known and the security assessment later holds fewer surprises. The output is a short requirements register that your board, your partners and our engineers all read from, which keeps later debates about scope short and factual.
Schedule a free consultation and get a written recommendation, with costs, before you commit to anything.
Get in touchPROVEN RESULTS
Swift
Kotlin
Flutter
React Native
PostgreSQL
MySQL
MongoDB
AWS
Azure
Docker
GA4
Google Tag Manager
Search Console
Meta Pixel
Looker Studio