iPKO biznes: Building Excellence in Corporate Mobile Banking

Client: PKO Bank Polski, Poland’s leading banking institution, serving over 12 million customers through nearly a thousand branches nationwide

Industry: Banking 

Scope: Mobile app development and long-term evolution of a corporate banking app 

Key technologies: OWASP MAS standards, mTLS

Timeline: 2016–present

Challenge

In 2016, PKO Bank Polski initiated a strategic project to develop iPKO biznes, a mobile application tailored for corporate clients. The initial goal was to provide companies and enterprises with mobile access to banking services. 

But over the years, the project’s scope extended beyond that. Today, it aims to create a comprehensive digital solution that delivers tangible value to both the bank and its business clients. Thus, the challenge for Neontri was twofold:

• Continuously evolve the platform to maximize business value and user adoption
• Build and maintain a secure, functional mobile banking application for corporate clients

Solution 

The iPKO biznes is a comprehensive mobile application that offers a wide range of features to deliver secure, convenient, and efficient banking services. The following overview details the app’s key functionalities.

Account management

Users can monitor detailed bank account information, including card details, available funds, daily limits, transaction history, and payment status, and get a clear view of their finances.

Dynamic multi-language support

The multi-language architecture in iPKO biznes delivers real-time translation management and customizable user preferences without requiring mobile app updates.

• Custom-built mechanism. The multi-language support was developed from scratch well before native OS support for per-app language preferences became available in new versions of mobile operating systems. 

• Supported languages. iPKO biznes currently supports Polish, English, Czech, and German, with plans to add Romanian. 

• Server-side management. Language content updates dynamically without requiring new app versions on Android and iOS.
• Decoupled label resources. Labels are loaded dynamically from a back-office configuration rather than being bundled with the release version, allowing language content to be modified for all users simultaneously. 
• Independent language setting. The app language can be set independently of the device’s system language, providing a unique UX tailored to the diverse needs of the bank’s international clientele.

Building for multiple markets?

Make localization part of the architecture

Schedule a consultation

Multiple banking contexts

Each context enables users to manage, sign, and authorize their transactions in one place. This functionality is beneficial for customers working across different companies who need to switch between accounts. The app supports context-specific transaction types, such as direct debit for the Czech context and SEPA transfers for the German context.

Request caching mechanism

The intelligent caching mechanism reduces the number of requests sent to the bank’s servers by storing specific data locally on the mobile device. Thus, instead of making repeated network calls for frequently accessed, low-volatility endpoints, the app can quickly retrieve this data from its local cache. 

The duration for which information remains valid in the cache is configurable on the back end. For instance, in the development environment, cached data typically expires after 60 seconds, though this period may be longer in the production environment to further minimize unnecessary network traffic. 

Transaction authorization

iPKO biznes offers several authorization options to facilitate customers’ day-to-day financial management:

• Hardware token. This physical device generates one-time codes via a challenge-response mechanism. It works like this: the bank provides a challenge (a number between 0 and 50), the user enters it into their hardware token, which then produces an 8-digit code used to authorize the transaction. This method ensures that only the legitimate customer can approve transactions, even if someone else gains access to their ID and login details.
• Mobile token. This method works similarly to the previous one but does not require an additional device. The process is integrated within the app, so users just enter an additional PIN to authorize transactions. If customers access their account on a different device, the mobile token behaves like a hardware token, ensuring the same level of security.
• Mobile authorization. It is the latest authorization method that uses push messages. When the transaction is authorized on a different device, the app receives a message containing the operation details for verification, which the user then approves with their PIN. For same-device authorization, the push notification step is skipped, making it the fastest secure authorization method available. The bank actively promotes it as the recommended option, with plans to phase out token-based methods.

Secure network communication

The iPKO biznes employs enhanced security measures for network communication between the app and the bank server. The app uses mutual Transport Layer Security (mTLS) to authenticate both parties in communication. Here is how it works: 

• The bank server authenticates itself to the app using its own server certificate, protecting against unauthorized access and security breaches.
• A unique cryptographic certificate is generated and securely stored within the app on the mobile device.
• The app uses the client certificate to digitally sign every request before sending it to the bank, allowing the server to verify the authenticity of each data exchange.

Delivery approach

The launch of the iPKO mobile banking app was a collaborative effort between Neontri and PKO. The team structure reflected a balanced mix of expertise from both organizations, ensuring comprehensive coverage of all tech and business requirements.

• UI/UX refinement. Engineers work closely with a UI/UX specialist with weekly refinement meetings. During these sessions, the team reviews newly developed screens to ensure the app’s interface and user experience meet PKO’s standards and customer expectations.

• Team structure. Neontri’s team comprises eight members: two iOS developers, one of whom also serves as the team leader, two Android developers, two back-end developers, and two manual testers. 

• Agile development framework. The collaboration is structured around the Scrum framework and organized into two-week sprints, culminating in a stakeholder presentation. This regular cadence allows for frequent feedback and adjustments, ensuring that the app’s evolution closely matches the client’s vision.

Results

Delivering iPKO biznes required technical expertise in mobile app development, a deep understanding of corporate banking needs, and stringent security requirements. Rising to this challenge, our engineering team achieved several milestones:

• Architectural excellence. The application is based on a hybrid modular architecture, with each feature built as an independent module with minimal inter-module dependencies. Every component is separated into UI, business logic, and data layers, improving scalability and maintainability.

• Advanced security. The application adheres to OWASP Mobile Application Security (MAS) standards:
  • Robust encryption for locally stored confidential data
  • Secure network communication via HTTPS protocol enhanced with mTLS and certificate pinning
  • Bi-annual external security audits, with no significant security breaches for four years in a row.
• User satisfaction. iPKO biznes achieved a 4.5 rating in the recent quarterly customer satisfaction survey, demonstrating an 11% improvement from the previous survey period. 

• Quality assurance. The app undergoes comprehensive testing, including manual and automated functional testing, manual acceptance testing, automated unit testing, and integration testing. A specialized environment component lets engineers mock back-end responses, streamlining implementation and QA.

Looking for a trusted partner for your banking app?

Whether you’re modernizing a legacy app or building corporate banking features from scratch, our team has the expertise to build secure, high-performance digital platforms.

Get started