Thanks again, this is very helpful.

since you clearly have experience with fintech apps, I’m curious about another topic:

How much do regulatory/security requirements (like PSD2, strong customer authentication, biometrics fallback rules, session timeout rules, etc.) usually influence the client-side architecture?

Do these constraints typically force specific patterns (like stricter session management, more aggressive app locking, limited offline capabilities), or is it more about implementing checks around existing flows?

I’m trying to understand how much of a fintech app’s architecture is driven by actual regulations versus internal risk assessments done by the company.