Fintech software outsourcing checklist. The answers to look for

Your shortlist has three firms, and each pitch deck says "we do payments." A generic checklist won't tell them apart. In fintech software outsourcing, six questions about payments work do a better job. Teams that build fintech software for production answer them with provider names and volumes.

What should you ask a vendor before outsourcing payments development?

Here are the questions to ask software vendors before payments work starts:

1. Which PSPs, rails, and acquirers have you integrated in production?

2. How do you handle PCI DSS scope, PSD2/SCA, KYC/AML, and audit evidence?

3. How do you handle failed transactions, retries, idempotency, and reconciliation?

4. Who owns the code, the provider relationships, and incident response after go-live?

5. How fast does the team start, and what happens when an engineer leaves?

6. Where do you use AI tools, and who reviews AI-written payments code?
   
   

A wrong pick is expensive. RedCompass Labs surveyed 300 senior payments professionals at US banks in 2025. They said 83% of their payments projects ran late and 87% went over budget. The average troubled project lost $496,953. Regulation (41%), legacy systems (36%), and budget (35%) topped their list of barriers.

What does a credible answer on payments experience sound like?

A credible answer names systems and numbers that only exist in production. RedCompass respondents also blamed a shortage of skilled people, and 63% plan to bring in specialist payments consultancies.

• Ask: Walk me through one payments system you shipped: what it connects to, how long it took, what changed. Follow up on its PSPs, rails, and volume.

• Green flag: Named systems, a delivery timeline, and a before-and-after number from live traffic.

• Red flag: No payments system they can walk you through, even with the client name redacted. "We'll learn your PSP" is fair from a team with other PSPs in production, and a red flag from one with none.

The xpate build is a good first answer. Sellers on the UK payment platform used to wait 3-10 days for payouts. A serverless platform on AWS connected a payment gateway, a ledger, an omnichannel communication platform, and a signing platform. It went live as an MVP after 4 months, and payouts dropped to minutes.

The platform now runs 3M+ transactions a month across SEPA, SWIFT, FPS, FX, crypto, and card payouts. Hold every firm on your list of payment software vendors to that level of detail.

What should a good answer on PCI DSS, SCA, KYC/AML, and audit evidence include?

Compliance should sit inside delivery, with every decision documented and signed off by your team. In the EU, DORA (Regulation (EU) 2022/2554) has applied since January 2025 and keeps financial entities fully responsible when ICT providers do the work. Article 28 adds a register of those arrangements and exit strategies for critical or important functions.

For non-ICT services, the EBA's September 2026 guidelines (EBA/GL/2026/09) set similar rules and replace its 2019 outsourcing guidelines.

Ask how they handled PCI DSS scope, SCA, and KYC/AML checks on a past build, and what audit evidence it produced. A strong partner keeps card numbers off your servers with tokenization or hosted fields. SCA follows Delegated Regulation (EU) 2018/389, and every test run is stored as audit evidence. The red flag is "we're PCI-compliant" with no scope diagram behind it.

The license stays yours, whoever builds the onboarding flow. In July 2025, the UK's FCA fined Monzo £21.1 million. Its onboarding and transaction monitoring hadn't kept up as customers grew nearly tenfold.

How should a partner answer questions about failed transactions and retries?

Good partners start with failure. Networks time out and PSPs send ambiguous responses, so clients retry. If a request that moves money carries no idempotency key, a retry can charge the customer twice.

Stripe's API returns the saved first response to any retry with the same key. Reconciliation then matches every ledger entry against PSP settlement reports, so a stuck payment surfaces before a merchant notices.

Test it with a PSP call that times out halfway through a payout.

• Green flag: Idempotency keys, retries with backoff, a state machine for each transaction, and automated reconciliation against PSP reports.

• Red flag: "The PSP takes care of that," or no plan at all.

Weak failure handling ends in outages. Financial services firms lose $1.69 million per hour of high-impact outage, according to New Relic's 2026 Observability Forecast. More on why payment system integration fails so often.

Which answers on ownership and continuity can you put in a contract?

Accept only answers you can write into the custom software development contract. Four clauses matter most: code and IP assigned to you, PSP accounts in your company's name, a documented handover, and an exit plan. For EU firms, the exit plan doubles as DORA's exit strategy for critical functions.

Ownership and team integration

• Green flag: All four clauses in the draft, plus an incident runbook and a named on-call owner.

• Red flag: The partner signs PSP agreements in its own name.

Ownership also covers who sets priorities. A UK business lender had an MVP but lacked the expertise to scale it. A 14-person team joined the lender's developers and worked under its Product Owner, automating background checks.

Applicants could then get an indicative loan offer in 5 minutes instead of 90 days. The platform signed up 150+ business clients.

Ramp-up and continuity

Ask who replaces your lead engineer if they leave next month, and how soon the replacement ships.

A good partner names a team with knowledge spread across several engineers. A weak one depends on one key engineer.

Hiring is slower. The Linux Foundation's 2025 State of Tech Talent report puts hiring and onboarding a technical employee at 8.4 months, or 7.8 in Europe. xpate had an 11-person team in place within a month and has kept the same partner since 2022.

That gap sits at the core of any in house vs outsourcing software development decision. The in-house vs. outsourcing guide for fintech covers the other pros and cons of outsourcing software development.

What makes an answer on AI-written payments code safe?

A safe answer names the senior engineer who signs off every change to payment logic and answers for it in production. In Stack Overflow's 2025 Developer Survey, 66% of developers named "almost right, but not quite" AI answers a top frustration.

Ask for their review rule. Good partners document where AI is used in each phase and keep client data out of unapproved tools. "AI writes most of our code," with no review policy, should end the call. For audit trails and data access, see the risks of AI coding tools in regulated fintech.

Key insights

• Specific answers predict delivery better than portfolios,

• Failure handling deserves more interview time than features,

• Exit terms and documentation belong in the contract before kickoff.

CTOs who picked well ran the shortlist as a technical interview and hired the partner with production evidence for all six answers.