Loans, check discounting, investments and insurance in one regulated fintech.

I owned the technology of Camelus, an Argentine fintech regulated by the BCRA. What started as a single lending product shipped as five — loans, check discounting, investments, insurance and a digital wallet — on an iOS and Android app, a public web app, a staff back-office and an insurance portal.

Behind them sit four backends that share no database. One service issues identity, a stateless BFF re-signs a short-lived token on every request, and each domain owns its own data and events. Because this is money and legal paperwork, the sensitive paths are the strict ones: electronic signatures with HMAC-verified webhooks, TOTP on privileged actions, biometrics and a session lock on mobile, and an audit row for every back-office write.

The flow that took the most work is the loan application end to end: simulation, a form that validates the CBU, photos of both sides of the ID, the contract PDF and its signature, and from there a state machine the team follows from the back-office until the money lands. Every change is recorded, with its reason and who made it.