Bureau De Change Platform

need a complete, professional bureau-de-change and money-transfer platform consisting of a responsive website plus iOS and Android apps.

The goal is one unified fintech experience where customers can view live FX rates, calculate exchanges, buy/sell or send money, complete KYC, make payments, receive notifications, and track transactions in real time.

The platform must be suitable for a Canadian/Québec regulated money-services business, with strong KYC/AML, transaction monitoring, audit trails, security and reporting. It must also be designed for future physical bureau-de-change locations, cash transactions and multiple branches.

1. Website & Mobile Apps
Responsive web application
iOS app ready for App Store submission
Android app ready for Google Play
Shared secure backend/API
Fast, modern fintech UX
French primary language, English support, Arabic-ready architecture
Mobile-first design
SEO-friendly public pages
Secure customer portal
Real-time FX calculator
Apps should feel native, not simply wrapped websites
2. Customer Accounts

Customers must be able to:

Register/login securely
Reset passwords and use MFA/2FA
Manage personal information
Complete KYC
Upload ID documents
Complete selfie/liveness verification where supported
View KYC status
Add/manage beneficiaries
View transaction history
Download receipts
Track transactions
Receive email/SMS/push notifications
Contact support

Clearly distinguish customer, beneficiary, payer and recipient and include controls against unauthorized third-party transactions.

3. Exchange & Transfer Flow

Customer flow:

Select service
Select currencies
Enter amount
Display live FX rate
Display fees
Display amount received
Confirm transaction
Complete KYC/compliance requirements
Select payment method
Submit payment
Confirm payment
Compliance/operations review when required
Approve/reject
Process transaction
Notify customer
Complete transaction

Show rate, fees, amount sent, amount received, reference number and status clearly.

4. FX Rate Engine

Create one centralized rate engine used by web, iOS, Android, calculator and transactions.

Admin must be able to:

Set buy/sell rates
Configure spreads/margins and fees
Enable/disable currencies
Schedule rate changes
Override rates
Set minimum/maximum amounts
Configure online/branch rates
Configure volume or customer-specific pricing

Architecture must support future FX market-rate, liquidity and pricing-provider integrations.

5. Calculator

Professional live calculator with:

Currency selection
Amount input
Live buy/sell rate
Fees and FX margin
Final amount received
Configurable pricing tiers
Copy/share results
Email/WhatsApp sharing

Calculator and actual transactions must use the same pricing engine.

6. Payments

Support secure integration with:

Interac/payment providers
Payment gateways
EFT/bank payment providers
Future card payments
Future in-person payments

Use APIs/webhooks for payment status and reconciliation. Do not unnecessarily store sensitive payment credentials.

7. KYC / AML / Compliance

Support:

Identity and ID-document verification
Selfie/liveness verification
Beneficiary information
Source-of-funds
Purpose of transaction
Risk flags
Transaction and velocity limits
High-value transaction review
Additional document requests
Compliance holds
Manual approval/rejection
Compliance notes
Complete audit trail

Compliance rules must be configurable and updateable without rebuilding the platform.

8. Transaction Management

Every transaction requires a unique reference and complete history.

Statuses should include:
Draft, KYC Required, Awaiting Payment, Payment Received, Under Review, Compliance Hold, Approved, Processing, Completed, Rejected, Cancelled and Refunded.

Every status change must be timestamped and linked to the responsible user or automated process. Confidential compliance information must remain internal.

9. Admin Dashboard

Administrators must operate the platform without touching code.

Customers: search, profiles, KYC status, documents, transactions, account status, notes.

Transactions: search/filter, review, approve/reject, hold, request documents, refund, timeline, export.

Rates: rates, spreads, fees, currencies, limits and scheduled changes.

Compliance: KYC queue, AML/risk alerts, high-value reviews, source-of-funds reviews, beneficiary reviews, notes and audit logs.

Reports: transaction volume/count, fees, revenue, FX spread revenue, currency volumes, customer activity, pending/completed/rejected transactions, refunds and CSV/Excel export.

10. Future Physical Bureau de Change

The architecture must support future physical locations with:

Cash buy/sell
Cashier accounts
Branch accounts
Till management
Vault management
Currency inventory
Cash reconciliation
End-of-day closing
Cash deposits
Printed receipts
In-person KYC
Branch-specific rates/limits
Branch reporting
Multiple branches

Online and physical transactions should use the same customer, transaction, compliance and reporting infrastructure while remaining identifiable by channel.

11. Security

Use current security best practices:

MFA/2FA
Role-based access control
Encryption in transit/at rest
Secure document storage
API authentication
Secure sessions
Rate limiting
Input validation
OWASP protections
Secure secrets/environment management
Audit logs
Backups/recovery
Monitoring/error tracking

Changes to rates, fees, transactions, refunds, customer accounts, compliance decisions and permissions must be auditable.

12. User Roles

At minimum:

Super Admin
Compliance Officer
Operations/Admin
Customer Support
Branch Manager
Cashier
Customer

Permissions must be granular.

13. Notifications

Support email, SMS, push and optionally WhatsApp for registration, KYC status, document requests, transaction creation, payment received, review/hold, approval, completion, rejection and refunds.

14. Technical Architecture

You may choose the stack, such as React/Next.js, React Native, Flutter, Node.js, Python or another suitable technology.

Priorities:

Secure
Scalable
Fast
Maintainable
API-first
Modular
Well documented
Easy to deploy
Easy to integrate with third parties

Web and mobile must use the same centralized backend for customers, transactions, rates, compliance, payments and notifications.

The architecture should support thousands of transactions per month and substantially higher volumes later.

15. Infrastructure

Provide separate development, staging/sandbox and production environments with:

Database
Secure API
Document storage
Monitoring/logging
Backups
SSL
Domain configuration
CI/CD where appropriate

Never hard-code passwords, API keys or secrets. Provide an environment-variable template.

16. Deliverables
Production-ready web application
iOS and Android apps
Backend/API
Admin dashboard
Database/schema/migrations
FX engine
Transaction engine
KYC/AML integration
Payment integration hooks
Notifications
Role-based permissions
Audit logs
Reporting
Source code
Environment configuration
API documentation
Deployment/setup documentation
Sandbox/test credentials
Automated tests for critical functions
17. MVP Acceptance Criteria

The MVP must demonstrate:

Correct live FX rates across web/iOS/Android
Customer registration/login
Sandbox KYC
Complete end-to-end exchange/transfer
Correct payment webhook/status handling
Admin approval/rejection
Rate changes without code changes
Consistent fee/rate calculations
Transaction history
Compliance audit logs
Notifications
Working permissions
Shared backend
Critical automated tests
Successful installation on a clean machine
Adequate deployment documentation
No critical security vulnerabilities
18. Development Phases

Phase 1 — MVP: Website, accounts, FX calculator, live rates, KYC, payments, transactions, admin dashboard, reporting, notifications and mobile apps.

Phase 2 — Advanced: Advanced AML/risk rules, KYB/corporate accounts, advanced reporting, automated reconciliation, additional payment providers, advanced pricing and accounting integrations.

Phase 3 — Physical Bureau: Cash transactions, till/vault management, currency inventory, cashier accounts, branches, in-person KYC and multi-branch reporting.

19. Proposal Required

Please provide:

Recommended technology stack and architecture
Database design
Security approach
KYC/AML and payment integration approach
Required third-party services
Fastest realistic MVP timeline
Development phases and cost
Estimated hosting/third-party costs
App Store/Google Play requirements
Information/access required from me on day one
Exact MVP scope
Features recommended for Phase 2
How the architecture will support the future physical bureau

Priority: Launch a secure, functional MVP as quickly as realistically possible while creating a scalable foundation for a complete online and physical bureau-de-change platform.