Banking as a Service: a banking platform built end to end

A multi-entity platform that lets a company set up its entities in Europe and the US, collect from customers through payment links and invoices, approve and pay supplier expenses from its bank accounts, and keep everything in sync with its accounting. As CoinPanel's fractional CTO, I designed and built all of it.

My role: Fractional CTO, architecture and full development
Client: CoinPanel, Sweden
Stack: Python, FastAPI, PostgreSQL, React 19, Cloud Run
Integrations: Stripe Connect, Revolut, Xero, Wise

Balance history with charges, payouts and fees on the platform

187documented API operations
6financial and accounting integrations
3environments: test, sandbox and production
EU + USlegal entities from a single backend

The challenge

Turning a trading product into a platform other companies could integrate to collect, pay and reconcile, with the security and traceability the financial sector demands, across two jurisdictions and without a large team behind it.

What I built

A Python backend with FastAPI and PostgreSQL: a modular monolith with routes split by audience (business, end customer, public payments, webhooks).
Collections with Stripe Connect: each legal entity is a connected account, with separate credentials for Europe and the US.
Payments and treasury with Revolut Business and Wise, including drafts that need human confirmation before they run.
Two-way sync with Xero and Hiveage, reversible invoice by invoice, and automatic invoice reading with OCR.
Supplier expenses with a role-based approval flow and a full audit trail.
A developer console for customers: API keys, signed webhooks and OpenAPI documentation.
Frontend in React 19, TypeScript and Vite; infrastructure on Google Cloud with Terraform and CI/CD on GitHub Actions.

The platform

Xero integration — Xero invoices with their Stripe sync status.

Expenses and approvals — Supplier expenses with their approval flow and source (manual, OCR or Xero).

Developer console — Customer console: API keys by prefix and signed outgoing webhooks.

Security and traceability

Verified webhooks

Signatures checked on every incoming webhook (Stripe, Revolut, Wise) and HMAC signatures on outgoing ones, with replay protection.

Secrets out of the code

Credentials in Secret Manager, third-party OAuth tokens encrypted at rest and API keys stored only as hashes.

Role-based access control

Five permission levels declared on every endpoint, and tokens that don't work outside their audience.

Four-eyes payments

A supplier can't be paid until someone approves their bank details, with a record of who did it and when.

End-to-end traceability

One request ID in every structured log line: any operation can be traced back from the HTTP response.

SSRF protection

Customers' webhook URLs are checked against private networks before every delivery.

Technical decisions

An outbox for webhooks

Events for partners are queued and delivered with retries: a partner being down never blocks or loses a payment.

Code version in the token

Changing one constant invalidates every session instantly, with no revocation table or extra queries.

The sandbox as a product

The same container serves all three environments; in sandbox mode it switches on docs, limits and demo data for a self-service public demo.

Outcome

A BaaS platform in production, with tagged, auditable releases, an open sandbox used by customers, sales and investors, and a technical foundation CoinPanel built on its experience in real-time crypto trading.

Building a fintech product?

info@adriasoft.es