Skip to content
Engineering a SAMA-Compliant Loan Originating System (LOS)
- API Integrations, Backend Development, Cloud Architecture, UI/UX Design
- GCP, Nest.js, Next.js, Node.js, React, Terraform
Saudi Arabia (KSA)
12 weeks to SAMA-compliant MVP
The Challenge: Navigating Compliance in Custom Fintech Software Development
A rising fintech startup in Saudi Arabia approached Coderfy with a critical mission: build a fully digital, multi-vendor marketplace for personal lending.
However, building commercial loan originating software isn’t just about a beautiful mobile app. The real challenge was engineering a backend infrastructure that could pass the rigorous Minimum Viable Controls (MVC) and cybersecurity audits of the Saudi Central Bank (SAMA). The client needed an architecture capable of processing real-time API calls to national databases, guaranteeing data privacy, preventing internal fraud, and calculating dynamic credit scores on the fly. And it was all RTL with the Arabic content and UX UI system – you get the easiness of the loan originating system we’ve built.
Under the Hood: A Secure, Cloud-Based Loan Origination System
We didn’t build a standard website; we built a secure financial vault. Operating on a “Half the price, faster twice” methodology, we deployed a cloud-based loan originating system using Google Cloud (GCP) and Terraform scripts for scalable, automated infrastructure.
To ensure enterprise-grade security and pass the SAMA audit, our Node.js/PostgreSQL architecture includes:
Maker-Checker Workflow
A mandatory dual-approval logic in the Super-Admin Panel. "Makers" initiate loan approvals, and "Checkers" verify them, eliminating the risk of internal fraud.
Strict Device Registration
Advanced session control that restricts account access exclusively to trusted devices. The system tracks the Device ID, OS, and Model, limiting users to a maximum of 3 verified devices (secured via OTP). Unrecognized logins instantly trigger a 412 Precondition Failed protocol, forcing reverification.
Comprehensive Audit Logging
Tracking and recording every action taken by administrators and borrowers. Our system logs user-agents, IP addresses, request/response bodies, headers, and execution times for strict compliance reporting.
Automated Credit Scoring & National Integrations
The true power of this white label fintech platform lies in its automated decision engine. We seamlessly integrated complex third-party services to eliminate manual underwriting:
Biometric KYC (NafathApp):
Deep API integration with the national Nafath service. The system generates unique transaction IDs and securely handles asynchronous callback webhooks to verify user identities instantly.
Dynamic Credit Scoring (SIMAH):
We developed an automated engine that pulls live salary certificates and credit data from the SIMAH bureau. The software calculates the borrower’s Debt Burden Ratio (DBR) and evaluates them against specific provider criteria (e.g., min_salary: 10000, max_dbr_rate: 65%, min_simah_score: 350).
Anti-Money Laundering (Sanctions.io):
Automated global AML background checks trigger instantly when a loan request is submitted. If a user is flagged, the system assigns a needs_check status, pausing the application for manual admin review.
Building Your Own
Lending Platform?
Don't Start with Loan Originating System From Scratch.
We spent thousands of engineering hours perfecting this SAMA-compliant architecture. If you are a bank, credit union, or startup looking for reliable loan origination software, you don’t need to reinvent the wheel.
License Coderfy's Pre-Engineered Fintech Core
We do not sell cheap "clone scripts."
We provide an Enterprise-grade foundation with 100% Source Code Ownership.
You get 80% of the complex backend (KYC, Security, Integrations) ready on day one.
We then customize the remaining 20%
- the UI/UX
- specific scoring formulas
- local payment gateways
to fit your exact market needs.
CTO Insight: The Real Challenge
The real challenge wasn’t just building a loan application form. It was engineering a banking-grade vault that feels like a modern startup app. We had to ensure the architecture could pass the Saudi Central Bank’s (SAMA) strict Minimum Viable Controls while processing National ID (Nafath) callbacks and SIMAH credit scores in milliseconds. This project proves that with the right microservices architecture, you don’t have to sacrifice speed for security.”
Straight Answers to Hard Questions
Technical insights into how we engineered this SAMA-compliant lending platform.
Have a question about pricing?
How long did it take to develop this custom Loan Originating System?
By utilizing our pre-engineered backend modules for core banking functions, we delivered the MVP with full SAMA compliance readiness in just under 12 weeks — saving the client months of from-scratch development.
How does the system handle data security and compliance?
We implemented mandatory Maker-Checker workflows, immutable audit logs, and Device Registration logic that restricts account access strictly to verified devices via OTP. Every request body, IP address, and execution time is logged for the regulator’s audit trail.
Can this architecture integrate with local credit bureaus?
Yes. The system includes custom API wrappers designed to communicate with SIMAH — pulling real-time salary certificates and credit scores — alongside Nafath for instant biometric KYC verification via asynchronous callback webhooks.
Do you provide the source code if we build a similar platform?
Absolutely. Unlike renting a SaaS platform, this is a custom software development model. You receive 100% intellectual property (IP) ownership and the complete source code upon project completion.
An online estimate gives
you a ballpark.
We give you a guarantee.
Jumping straight into coding based on a rough estimate leads to scope creep and wasted money. Before you invest tens of thousands of dollars, invest in certainty.
In just 2 weeks, our Business Analysts and CTO will provide you with a ready-to-use Request for Proposal (RFP) document, including:
- Launch faster. Quote smarter. Close more deals.
- Clean, conversion-focused layouts.
- Professionally designed RFQ templates that help you streamline request processing.
You can use this technical blueprint to build with us, or take it to any other agency. Start the smart way.
The Engineering Behind Modern LendingRead More About Our Technology
Building resilient loan origination software requires more than writing code — it demands a lending origination system engineered for regulation from the first commit. As financial rules tighten globally, off-the-shelf SaaS products consistently fail the security and audit requirements that central banks impose on a credit origination system: immutable decision logs, national-ID verification, credit-bureau integration and data residency.
The Muqaranah platform shows what that means in practice. Built for the Saudi market under SAMA regulation, it pairs a Next.js web platform and React Native mobile apps with a Nest.js backend, a React-based admin panel and a real-time monitoring dashboard, deployed on Google Cloud. The lending origination system verifies applicants through Nafath national identity and pulls credit data via SIMAH, Bayan and Dakhli adapters. Loan products are configured through bilingual (Arabic/English) dynamic forms with built-in KYC steps and a configurable scoring engine, while tab-level admin permissions separate super-admin, staff and loan-provider roles. A provider health-check layer monitors API status across a network designed to scale to 70 lenders — so the credit origination system keeps processing applications even when an individual provider integration degrades.
Related projects
Croatia / Southern Europe
Pre-Launch Beta and stabilization
Ukraine (Kyiv)
4 months
