Mobile App Development Company in Edinburgh

An Edinburgh app budget is set by which supervisory regime the product falls under. Quotes are fixed-fee in GBP rather than bands or open T&M, so finance teams at RBS Group or Lloyds Banking Group can plan against a known number. A scoped Edinburgh mobile MVP is a fourteen to twenty week engagement covering native iOS and Android, a Strong Customer Authentication or Open Banking integration where in scope, a Consumer Duty outcomes map, a UK GDPR data-protection impact assessment, and an accessibility audit against WCAG 2.2 AA and the Equality Act 2010. A production retail banking or wealth-platform application for RBS, NatWest, Lloyds Banking Group, Bank of Scotland, abrdn, Baillie Gifford, FNZ, Scottish Widows, or Aegon UK runs six to twelve months including PRA SS1/21 operational-resilience documentation, ForgeRock or Auth0 authentication integration, a fraud-detection layer, and the change-management pack the bank's internal audit and the FCA Senior Managers Regime accountable executive will sign. Skyscanner-style consumer travel apps on Flutter or React Native are scoped against store-experimentation infrastructure and back-end depth. Edinburgh sits just below London on the same scope and well above Glasgow or Manchester because of the abrdn, Baillie Gifford, FNZ, and Scottish Widows engineering salary premium.

FCA Consumer Duty under PS22/9 came into force on 31 July 2023 for new and existing products and on 31 July 2024 for closed products, and the cross-cutting rules require firms to act in good faith, avoid causing foreseeable harm, and enable customers to pursue their financial objectives. Our Edinburgh discovery includes a Consumer Duty outcomes-mapping workshop covering the four outcomes (products and services, price and value, consumer understanding, consumer support), with explicit consumer-vulnerability segmentation under FG21/1 reviewed against the bank's complaints log. Build sprints close every screen against a documented Consumer Understanding test (Flesch-Kincaid grade level, plain-English review, the FCA's published readability expectations) and a price-and-value review where pricing or fees are presented. Deployment ships with a Consumer Duty Manager dashboard the bank's accountable executive under the Senior Managers and Certification Regime can use to evidence ongoing outcomes monitoring to the FCA, which is what NatWest, Lloyds Scotland, Scottish Widows, and Aegon UK auditors actually want to see when the supervisory letter lands.

PRA Supervisory Statement SS1/21 on operational resilience and the equivalent FCA PS21/3 came into force on 31 March 2022 with the three-year implementation horizon expiring on 31 March 2025 — every Edinburgh-headquartered bank, building society, and PRA-designated investment firm must now operate within board-approved impact tolerances for important business services. Our delivery pack includes an important-business-service mapping for every mobile flow, a board-signable impact-tolerance proposal in elapsed-time terms, a severe-but-plausible scenario library covering ransomware, cloud-region failure, third-party SaaS outage (ForgeRock, Auth0, TrueLayer, AWS eu-west-2), and concentrated-supplier failure, tabletop exercise scripts the COO function at RBS, NatWest, Lloyds Banking Group, Bank of Scotland, Scottish Widows, or Aegon UK can run with the executive committee, and lessons-learned templates that feed the SS1/21 annual self-assessment. The PRA expects evidence of recovery within the impact tolerance, not just a written commitment, so the documentation closes with a tabletop execution log from a production-equivalent rehearsal.

Strong Customer Authentication under the UK Payment Services Regulations 2017 (which retained the EU PSD2 SCA framework after Brexit, with FCA-issued amendments) requires two-of-three factors from knowledge, possession, and inherence on most electronic payments and account-information access. Our Edinburgh banking apps use biometric inherence via LocalAuthentication on iOS and BiometricPrompt on Android with a Face ID and fingerprint failover pattern, possession via the device-binding model the FCA Regulatory Technical Standards on SCA endorses (device-fingerprint plus app-attestation via Apple App Attest and Google Play Integrity), and knowledge via a PIN or password gate where the regulatory technical standards require a third factor. The transaction-risk-analysis exemption under Article 18 RTS is wired in for low-risk transactions where the firm's fraud rate against published thresholds qualifies, the trusted-beneficiary exemption under Article 13 is wired for whitelisted payees, and the recurring-transaction exemption under Article 14 is wired for subscription billing. Every exemption ships with the audit-log evidence the FCA supervisory letter will request when fraud telemetry triggers a review.

The University of Edinburgh's School of Informatics has placed first in the UK for computer-science research output in multiple years (CSRankings, REF assessments) and operates ELLIS Unit Edinburgh and the Bayes Centre as the applied-research gateways for industry collaboration on AI and data science. When a mobile-AI feature requires genuine research depth (on-device LLM compression for Skyscanner-style consumer search, novel fraud-detection architectures for RBS or NatWest, biometric liveness for Scottish Widows or Aegon UK), we scope a Bayes Centre Industrial Doctorate, an ELLIS PhD-internship, or a direct School of Informatics consultancy rather than overselling in-house capability. Our core team handles the applied engineering, the productionisation, and the mobile-platform integration — which is where most academic AI work actually stalls. For standard work (Core ML on iOS, ML Kit on Android, Vertex AI or AWS Bedrock backends) no academic partner is needed and we will say so. Heriot-Watt's robotics and conversational-AI groups and Edinburgh Napier's cybersecurity unit are the right partners on different verticals, and we keep introductions warm with all three.

We default to UK and EU residency for Edinburgh banking, life-insurance, and asset-management apps because the FCA, PRA, and Information Commissioner's Office data-flow expectations are clearest there. AWS eu-west-2 (London) is our default with eu-west-1 (Dublin) as the documented severe-but-plausible failover, Azure UK South (London) is the alternative with UK West as failover, and GCP europe-west2 (London) is the third option with europe-west4 (Netherlands) as failover. Where a client risk posture requires UK-only residency we restrict to AWS eu-west-2 with the SS1/21 important-business-service explicitly mapped to a degraded-mode pattern rather than a cross-region failover, and we document the trade-off in the operational-resilience pack. Cross-Atlantic transfers to the US are governed by the UK Extension to the EU-US Data Privacy Framework with a documented Transfer Impact Assessment after the UK version of Schrems II reasoning, or kept out of the architecture entirely where the FCA supervisory letter history suggests it is the lower-friction choice. Every residency decision is documented in the UK GDPR data-protection impact assessment.

A typical Edinburgh production banking or wealth-platform application for RBS, NatWest, Lloyds Banking Group, Bank of Scotland, abrdn, Baillie Gifford, FNZ, Scottish Widows, or Aegon UK takes eighteen to twenty-eight weeks from kickoff to first production release, with another six to eight weeks of gradual rollout under feature flags and Senior Managers Regime sign-offs. Weeks one to four cover discovery, Consumer Duty outcomes mapping, PRA SS1/21 important-business-service classification, and the UK GDPR data-protection impact assessment. Weeks five to fourteen cover native iOS and Android build sprints with the Strong Customer Authentication, biometric step-up, and Open Banking integration wired in. Weeks fifteen to twenty cover internal-audit review, the SS1/21 severe-but-plausible scenario tabletop, the FCA Senior Managers Regime accountability mapping, and the change-management pack. Weeks twenty-one onward cover gradual rollout. Consumer travel or entertainment apps on Flutter or React Native typically halve the timeline because the governance overhead drops out, and we say so up front rather than padding the proposal.

Most custom Edinburgh mobile work qualifies for UK R&D Tax Relief under the merged scheme that came into effect from 1 April 2024 (replacing the separate SME R&D relief and RDEC schemes for accounting periods beginning on or after that date), returning roughly 15 to 16.2 percent of qualifying expenditure as a taxable credit for most firms, with the Enhanced R&D Intensive Support (ERIS) regime offering up to 27 percent for loss-making R&D-intensive SMEs that meet the qualifying intensity threshold. Eligible activity generally includes novel architectural work, algorithmic uncertainty, and systematic technological investigation — not routine integration of existing libraries. We deliver time-tracked logs, technical narratives, experiment histories, failed-hypothesis documentation, and the CT600L supplementary-form-ready evidence pack your R&D advisor expects. Scottish Enterprise grants (SMART:SCOTLAND, the R&D Grant Scheme, Innovate UK Smart Grants matched through Scottish Enterprise routes) can stack on eligible portions for SMEs with substantial Scottish operations. Final eligibility sits with your R&D Tax Relief advisor, HMRC, and Scottish Enterprise rather than with us, and we provide the documentation rather than the legal opinion.