Secure Android Finance App

I need a production-ready Android finance application that will easily clear a formal security review. I will hand over the compliance matrix, API partner documentation, and branding assets; your job is to transform them into a polished, secure app that covers:

• On-boarding with KYC checks and biometric login (fingerprint / face).
• Encryption at rest and end-to-end TLS in transit.
• Account dashboard showing real-time balance updates with a detailed breakdown of holdings.
• Searchable transaction history pulled via partner APIs.
• Full audit trail—every critical user action logged immutably for future audits.

The build must follow modern Android best practices (Kotlin preferred, Jetpack, MVVM, OWASP Mobile Top 10 mitigation) and ship with reproducible builds, unit/instrumentation tests, and straightforward CI/CD scripts so the codebase passes static analysis without surprises.

Deliverables
1. Source code repo with clear README and build instructions.
2. Signed release APK / AAB ready for Play Console upload.
3. Security documentation: data-flow diagram, crypto choices, threat model, and test results.
4. Post-deployment support to fix any issues flagged during external pentesting.

I will provide test accounts for the KYC and banking APIs, along with compliance guidance. Please outline your proposed tech stack, prior security-focused Android projects, and estimated timeline.