Mobile App Development Company in London

Ask where the app sits on the FCA spectrum and the range narrows quickly: a scoped mobile app MVP at London rates, a production-grade fintech app with Open Banking AISP integration, FCA permissions support, Strong Customer Authentication, and full UK GDPR controls, or a regulated full-stack neobank-class build sized feature by feature. Scope drivers include iOS and Android (native or Flutter / React Native depending on scope), a backend on AWS eu-west-2, payments via Stripe or GoCardless, App Store and Play Store submission, and a baseline accessibility pass. London rates sit above Manchester, Bristol, and Edinburgh because of the fintech and public sector compliance premium. We give fixed-fee proposals per release rather than open T and M.

Open Banking under PSD2 (and the UK’s emerging Smart Data laws under the Data Protection and Digital Information programme) requires you to either become FCA-authorised as an Account Information Service Provider or Payment Initiation Service Provider, or to integrate through an authorised TPP that holds those permissions. We typically integrate via TrueLayer, Yapily, or Tink as the FCA-authorised TPP and build the consent UX, account aggregation, transaction categorisation, and payment initiation flows on top, with PSD2-compliant Strong Customer Authentication (biometric plus device binding) done properly. For clients pursuing their own FCA authorisation we coordinate with their compliance team on the Open Banking Implementation Entity (OBIE) standards and the FCA application timeline. We have shipped consumer fintech apps in this pattern from London postcodes.

The ICO Age Appropriate Design Code (Children’s Code) applies to any online service likely to be accessed by under-18s and sets 15 standards including data minimisation, high-default privacy settings, no nudge techniques toward weak privacy choices, and age-appropriate transparency. Even if your target audience is adults, if under-18s are realistically likely to use the app you are in scope. Our discovery phase runs a Children’s Code applicability review, designs proportionate controls (age estimation or verification, parental controls, default-private profiles, no behavioural advertising to under-18s), and documents the decisions so an ICO query can be answered without a panic. The ICO has issued enforcement notices on this code and it is not theoretical.

Yes, where the use case is genuinely health-adjacent and your organisation can satisfy the NHS Digital onboarding requirements. NHS Login is the citizen identity service used by the NHS App, the GP online services, and a growing number of partner services, and integration goes through NHS Digital’s onboarding programme with Data Security and Protection Toolkit (DSPT) compliance, security assurance, and proportionate identity verification. The NHS App API allows partner services to integrate citizen-facing journeys such as appointment booking and record access through approved patterns. We have prepared London health-tech clients for this onboarding and can scope the engineering and compliance work realistically. We will not promise a six-week integration when the NHS pathway routinely takes longer.

We choose by team, performance budget, and regulatory load. Native Swift with SwiftUI on iOS and Kotlin with Jetpack Compose on Android is our default for FCA-regulated fintech, health, and any app where 60fps interaction, deep platform integration (Apple Wallet, Wallet passes, Live Activities, Dynamic Island, App Intents on iOS; Material You and platform widgets on Android), or strict security review is required. Flutter 3 is a strong choice for consumer scaleups where engineering capacity matters more than absolute native polish and where the team can commit to Dart. React Native 0.73+ works well for product teams already running a React web codebase who can amortise engineers across web and mobile. We will recommend honestly based on the brief, your hiring plan, and the App Store and Play Store review reality.

Apple’s App Tracking Transparency framework (iOS 14.5+) requires explicit user consent before tracking across apps and websites, and the ICO has issued guidance that requires consent of equivalent quality for any non-essential cookies and SDKs under PECR and UK GDPR. The two regimes interact and the lazy answer (default-on analytics) is now a compliance risk. Our standard pattern uses a properly built consent management platform (CMP), separates strictly necessary, analytics, and marketing categories, gates third-party SDKs behind consent, fires the ATT prompt at a moment that maximises legitimate consent rather than fatigue, and logs consent state in a way that an ICO audit or App Store review can verify. We have launched multiple London apps under this pattern without store rejection.

Yes. For public sector and regulated clients we build to the GOV.UK Service Standard and the NHS Service Manual, with Government Digital Service (GDS) patterns where they apply on web and adapted patterns for mobile. Accessibility conformance targets WCAG 2.2 AA as standard, with a published accessibility statement that complies with the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 (PSBAR). Our accessibility audits use a combination of automated tooling (axe, Accessibility Inspector, TalkBack and VoiceOver review), assistive technology testing, and a manual WCAG review. We deliver the Section 19 statement and the disproportionate burden assessment where it applies, signed off in a form your accessibility lead and the Government Digital Service can accept.

A typical London fintech mobile app takes sixteen to twenty-eight weeks from kickoff to a public App Store and Play Store launch, assuming an authorised TPP partner is already selected (TrueLayer, Yapily, or Tink) or your own FCA permissions are in place. Week 1 to 4 is discovery, regulatory mapping, and design system. Week 5 to 14 is core build (auth, accounts, payments, Open Banking). Week 15 to 20 is hardening, accessibility audit, security review, App Tracking Transparency and ICO consent rollout. Week 21 onward is App Store and Play Store submission, beta with TestFlight and Play Internal Testing, and phased launch. We have shipped consumer fintech apps to this cadence inside FCA-authorised stacks aligned with PSD2 Strong Customer Authentication.