Hello there. In finance, security-by-design isn’t optional, and vetting for teams that actually get that up front saves real grief. We had a comparable build and worked with Saritasa https://www.saritasa.com/mobile-app-development – security was part of their development and QA from the start, with penetration testing and proper documentation rather than a last-minute pass. They handled the regulated context without needing to be walked through why it mattered, and everything shipped on the estimated timeline. If I’m nitpicking, the discovery phase was detailed to the point of feeling slow, but that rigor is what produced a clean audit trail. Ask any candidate to walk you through their security testing process specifically – the ones who can’t get specific aren’t ready for regulated work.