The governed core for lenders, EMIs and new banks.
Ledger, deposits, lending, KYC and AML, documents and workflows as modules you rent. Nothing moves without a second person, and every action lands in a sealed audit trail.
Built on the standards European banking runs on
- ISO 20022pacs, pain and camt messages
- SEPA SCT and InstantFormats and clearing envelopes
- camt.053Statements from the ledger
- EUDI WalletOpenID4VP identity
- ICAO 9303ePassport chip checks
- FIDO2 and SCAPasskeys, payments bound to payee
Every change to a legacy core is a project.
A new product, a new fee, a new compliance rule: each one waits for a vendor ticket and a release. Steinvar turns that work into configuration, and keeps the control a regulator expects: versions, a second approver and a record of everything.
With a legacy core
- New products wait for a vendor release.
- Fee and rule changes are code changes.
- Compliance logic is custom development.
- Audit evidence is collected after the fact.
- Month end is a spreadsheet exercise.
With Steinvar
- Products are versioned templates your team configures.
- Fee schedules and rule sets are tested with a dry run, then approved.
- KYC policies, monitoring scenarios and workflows are data under four-eyes control.
- Every action is written to a sealed audit trail and kept for five years.
- Period close, year end and the trial balance come from the ledger itself.
Ten modules. One ledger underneath. Rent what you use.
Start with the modules you need. Renting one switches on its services and its screens for your workplace; everything else stays off.
Steinvar Ledger Accounts and general ledger
A double-entry ledger that closes its books.
Multi-currency accounts with holds, limits and a status lifecycle; a hierarchical chart of accounts; decimal amounts end to end; value and business dates on every row; append-only postings with maker-checker corrections; month close, year end and a trial balance in the back office; an hourly reconcile that freezes on drift.
Steinvar Flow Workflows and decisions
Processes you can see, test, approve and replay.
A visual flow designer with 34 operators, a dry run that writes nothing, restart from the failed step, a circuit breaker and dead-letter replay. Decision rule sets are staged, evaluated in a sandbox and approved before anything uses them.
Steinvar Payments Transfers and SEPA formats
Screened, limited and approved before it books.
Idempotent transfers with four-eyes on HQ payments, customer limits per transaction, day and month, both parties screened, and ISO 20022 messages with SEPA SCT and Instant envelopes. The rail connection runs through your sponsor bank or PSP.
- pacs.008
- pacs.002
- pacs.004
- camt.056
- camt.029
- pain.001
Steinvar Save Term deposits and savings
Deposit products defined in an afternoon.
Tiers, floating rates with floors, day-count conventions, compounding, early withdrawal with tax clawback, renewals and holidays, all declarative. Interest posts exactly once, every night.
Steinvar Lend Consumer loans
From application to collection, under two pairs of eyes.
Offers, applications, affordability with DSTI and observed income, two-person approval, agreements signed in Docs, daily interest accrual, a repayment waterfall, nightly collection, arrears and write-off.
Steinvar Verify KYC and KYB
Onboard people and companies in one reviewer queue.
Versioned policies in a visual editor, document and MRZ reading, ePassport chip checks, EUDI Wallet, registry lookups, UBO graphs, enhanced due diligence, periodic re-review and a hash-chained record of every decision.
Steinvar Screen Sanctions and AML
Hits reach two people, not a spreadsheet.
EU, UN, OFAC, UK and Lithuanian lists refreshed every six hours; both payment parties screened in real time; transaction-monitoring scenarios with versioned, approved parameters; alerts closed by two reviewers against an SLA.
Steinvar Docs Documents and e-signature
Contracts from draft to archive, with evidence.
Immutable versions, contracts and clauses, approval workflows with quorums, electronic signatures with sealed evidence and timestamped PDF seals, retention holds, webhooks and public signing links. Loan and deposit agreements are filed here on their own.
Steinvar Report Statements and returns
Statements from the ledger, every month.
Customer statements as PDF and camt.053, filed to Docs and e-mailed monthly; loan portfolio, arrears and income reports reconciled to the GL; CRS, CESOP, Bank of Lithuania and VMI formats generated for your submission channel.
Steinvar Notify Communications
Customer wording under the same control as code.
Templates versioned and approved, delivered by e-mail, SMS, Slack and in-app with a delivery log. Security codes, passkey mail and monthly statements use the same engine.
Records and amounts shown in previews are illustrative.
The back office your teams work in every day.
Payments, verification, workflows, approvals and the audit trail live in one HQ portal, organised by workplace: your company and its branches.
Payments
Instructions, approvals and bookings
Illustrative data
Answers to the questions a regulator asks.
Before a supervisor, an auditor or a sponsor bank lets a platform hold customer money, they ask the same things. Each answer below is behaviour that ships today.
- Who approved this?
- Payments, ledger corrections, the month close, flows, rule sets, KYC policies, templates, AML parameters, loan payouts and write-offs all need a second person. The maker cannot approve their own change.
- Can the books be closed?
- A monthly period gate refuses postings into a closed month. Year end moves the result to retained earnings. The trial balance comes from the ledger, integrity checks run on it, and any drift freezes posting until an approved request lifts it.
- Is every action on record?
- Signed events from every service, chained per workplace, sealed every 15 minutes, verified hourly, kept for five years with legal holds, and readable in the back office.
- Is customer money screened and monitored?
- Both parties of a payment are screened against lists refreshed every six hours. Transaction-monitoring scenarios run on approved parameters, and an alert or a false positive is closed by two reviewers.
- Is customer authentication strong?
- A second factor at sign-in and a code bound to amount and payee on every payment, with passkeys, lockout and an idle timeout. Staff password sign-in needs an e-mailed code, and approver roles can require a hardware key.
- What happens to personal data?
- Profiles, identity scans and card numbers are encrypted under separate keys. A consent register, data requests with statutory deadlines, and erasure judged against retention and legal holds, each approved by a second person.
- Is lending responsible?
- Affordability from declared and observed income with a debt-service ratio, cost-of-credit and penalty caps, the 14-day right of withdrawal, and two-person approval on every payout.
- Can it be operated?
- Health, metrics and traces on every service, alerts that reach people, a test suite that runs on every change, nightly ledger backups and a restore drill that passed.
From first module to daily operation in four steps.
Start in the sandbox
Register in the sandbox and switch on the modules you need. Each one turns on its services and screens for your workplace; everything else stays off.
Configure your operating model
Products, operations, posting rules, fee schedules, KYC policies and workflows are configuration your team edits, with versions.
Approve before it goes live
Flows, rule sets, policies, templates and AML parameters are approved by a second person. So are payments, corrections and the month close.
Operate and prove it
Run onboarding, payments, loans and end-of-day across HQ, branch and management portals, with every action in a sealed audit trail.
Built for the institutions where governance matters more than scale.
Lenders, electronic money institutions and new banks in the EU, starting in the Baltics. Each rents the modules its licence needs and keeps the rail with a partner.
Consumer lenders
Run loans end to end: affordability, two-person approval, signed agreements, daily accrual, collection, arrears and reports, with payouts through your partner bank.
Lend, Verify, Screen, Docs, Ledger
Electronic money institutions
Onboard with KYC and KYB, screen every payment, monitor transactions and keep a ledger a supervisor can read, while your sponsor bank carries the rail.
Verify, Screen, Payments, Ledger, Report
Deposit-takers and new banks
Term deposits and savings as declarative products, statements every month, strong customer authentication on every payment, and books that close.
Save, Ledger, Payments, Notify, Report
Design partners
Evaluate the governance model on your own products in the sandbox, then run a pilot where regulated money stays with a partner bank.
Every module, sandbox first
Rent what you use. Start where it costs nothing.
Modules are rented per workplace, monthly or annually, and billed to a prepaid balance. The sandbox is the same platform with your own configuration.
Sandbox
Free
Register your company, rent the modules you want to evaluate and configure your own products, policies and flows.
- Every module available
- Your own workplace and users
- Nothing to install
Pilot
By agreement
Run your products on the platform with regulated money at a partner bank, and a roadmap we commit to together.
- Your configuration, migrated
- Named engineers, weekly releases
- Priority on the gaps you find
Production
Monthly or annual
Modules rented monthly or annually per workplace, usage-based where it fits, billed to a prepaid balance.
- Rent and release modules as you grow
- API keys and usage per module
- Monthly invoices from the ledger
Through partners, by design: the payment rail (a sponsor bank or PSP), card issuing and processing, credit-bureau data and qualified electronic signatures. We build the adapter; you choose the partner.
The standards and sources around a European institution.
Message formats, identity sources, watchlists and reference data are part of the platform. The payment rail itself is your sponsor bank or PSP.
Payment formats
- ISO 20022pacs.008, 002, 004; pain.001, 002; camt.052 to 056
- SEPA SCT and InstantEnvelopes for CENTROlink, ECB TIPS, SEPA-Clearer
- XAdESSigned payment files
- Your sponsor bank or PSPThe rail connection
Identity and company data
- EUDI WalletOpenID4VP, SD-JWT credentials
- ICAO 9303 ePassportsChip verification
- GLEIFLegal Entity Identifier lookup
- Lithuanian company registerCompany records and officers
Watchlists
- EU consolidated listRefreshed every six hours
- UN and OFACSDN and consolidated lists
- UK FCDOSanctions list
- Lithuanian FNTTNational list
Reference data
- Bank of Lithuania FX ratesDaily, with history and revaluation
- IBAN and BIC directoryValidation and bank registers
- Holiday calendarsBusiness days for deposits and night runs
Communications and billing
- E-mail and SMSSMTP and HTTP gateway providers
- SlackTeam alerts
- StripeModule billing and top-ups
Evidence and operations
- RFC 3161 timestampsOn sealed PDF documents
- Signed platform sealsAudit chain sealed every 15 minutes
- PrometheusMetrics from every service
- OpenTelemetryTraces across services, one trace id per request
- Health endpointsAlive and ready checks on every service
An API for every portal, idempotent where money moves.
Each portal has its own REST API with one response envelope, internal services talk gRPC over mutual TLS, and payments speak ISO 20022.
REST APIs per portal
HQ, branch back-office, platform management and customer e-banking, with one envelope and a trace id on every response.
Idempotency where money moves
Money routes take an Idempotency-Key; a retried request books exactly once.
gRPC over mutual TLS
Internal services identify each other by certificate, and the ledger path accepts only listed callers.
Webhooks and an OpenAPI spec
Document and contract events delivered to your systems, with a published OpenAPI definition.
Sandbox for rules and flows
Evaluate a rule set or dry-run a flow against your own input before it is approved.
Observable by default
Health, metrics and traces on every service; the trace id in a response is the trace id in the logs.
# A transfer from the HQ portal.
# Retried with the same key, it books once.
POST /api/v1/hq/apps/core/trx
Authorization: Bearer …
Idempotency-Key: 7c1e5d2a-…
X-Correlation-ID: 0b9f…
{ "operation": "SEPA_SCT_OUT", "amount": "2500.00", "currency": "EUR",
"debtor_account": "LT60…8901", "creditor_iban": "DE89…0130" }
# 202: screened and limited; waits for a second approver
{ "data": { "status": "AWAITING_APPROVAL" },
"meta": { "trace_id": "0b9f…" } }Security designed as if an auditor is watching.
Trust and security in detailStrong customer authentication
A second factor at sign-in, every payment confirmed by a code bound to its amount and payee, passkeys, lockout and an idle timeout.
Staff second factor and security keys
Password sign-in needs an e-mailed code; approver roles can be held to a hardware key.
Access scoped to your tenant
Roles are checked against company and branch on every request, every allow and deny is logged, and the build fails on an unscoped query.
Encrypted personal data
Client profiles, identity scans and card numbers are sealed under separate keys and stay searchable through blind indexes.
Four-eyes wherever money or rules move
Payments, corrections, month close, flows, rule sets, policies, templates, AML parameters, loan payouts and write-offs.
A sealed audit trail
Signed events from every service, chained per workplace, sealed every 15 minutes, verified hourly and kept for five years with legal holds.
Questions we are asked first.
Straight answers, including what the platform does not do yet. Anything else is in the trust and security details and the terms.
What is Steinvar?
Steinvar is a core banking and compliance platform delivered as modules you rent: a double-entry ledger that closes its books, term deposits and savings, consumer lending, KYC and KYB, sanctions screening and transaction monitoring, documents with e-signatures, statements, and a workflow engine. Every change to money, rules or configuration is approved by a second person and written to a sealed audit trail.
Who is it for?
Consumer lenders, electronic money institutions and new banks in the EU, starting in the Baltics, that need strong governance more than massive scale. You run regulated services under your own licence; we provide the software.
Can I try it before talking to anyone?
Yes. Register your company in the sandbox, switch on the modules you want and configure them with your own products, policies and rules. It is free, needs no card and nothing to install. Use test data, not real customer data.
Does it connect to SEPA payment systems?
The platform speaks ISO 20022 and produces SEPA Credit Transfer and Instant messages with the clearing envelopes, but it does not hold a direct connection to a clearing system. Payments go out through your sponsor bank or payment service provider, which we connect to.
How is it priced?
Modules are rented per workplace, monthly or annually, with usage-based charges where they fit, and billed to a prepaid balance. The sandbox is free. Design-partner pilots are agreed individually. We do not publish a price list yet.
Where is data hosted, and who owns it?
In the European Union, at OVHcloud in Gravelines, France. Data you put into the platform stays yours: we process your customers’ personal data only on your instructions, under a data processing agreement.
Is it certified?
Not yet. We hold no SOC 2, ISO 27001 or PCI DSS certification today. The controls are built so an auditor can verify them, and the Trust and security page lists them, including what is not in place yet, such as automatic failover to a second site.
What does it not do yet?
Card issuing and processing, PSD2 access for third-party providers, SWIFT, direct debits, Verification of Payee, IFRS 9 provisioning and filing regulatory returns directly to supervisors. Where these are needed we work through partners or put them on the roadmap with you.
Try it on your own products. Free.
Register your company in two minutes, switch on the modules you want to evaluate and configure them with your own products, policies and rules. Nothing to install, no card.
- Steinvar Ledger
- Steinvar Payments
- Steinvar Verify
- Steinvar Screen
- Steinvar Lend
- Steinvar Docs
- Steinvar Report
- Steinvar Flow
- Steinvar Decide
- Steinvar Notify