Regulated Mortgage Platform

The client is a regulated mortgage provider and property fintech operating in Indonesia, running a single platform that combines a curated property marketplace, project and mortgage financing, and ongoing management of the properties it finances. It lends both to residents and to non-resident borrowers buying into the Indonesian property market.

Pangolin acted as fractional CTO through the build, and delivered both the borrower-facing mobile app and the internal management platform.

The fractional CTO engagement

An early-stage regulated lender has to solve two problems at once: ship a product customers will actually use, and stand up the controls a regulator will accept. Those pull in opposite directions, and getting the sequence wrong is expensive, because retrofitting audit and access control into a system that was built for speed usually means rebuilding it.

The fractional CTO role covered the decisions that set that sequence: platform architecture, the boundaries between borrower-facing and internal systems, build versus buy on the pieces that were not differentiating, and how the technology posture would support the business operating as a licensed and regulated entity rather than an unregulated marketplace.

The borrower mobile app

Shipped on both iOS and Android. It carries the borrower journey end to end: browsing the curated property marketplace, starting a financing application, submitting the documents that application requires, and tracking progress through to decision.

Mortgage applications are document-heavy, and a borrower abandoning halfway through an upload flow is a lost origination. The app was designed so that the paperwork is collected progressively rather than demanded all at once, and so a borrower always knows what is outstanding and what happens next.

The management platform

The internal counterpart, covering the parts of the business the borrower never sees:

• Origination workflow, moving an application from submission through assessment to funding
• Two financing products, mortgage financing and project financing, which behave differently and needed separate treatment rather than one flow with exceptions
• Asset management for financed properties, including the performance monitoring and reporting provided to owners
• Revenue management, supporting the occupancy and average daily rate optimisation run with online travel agency partners
• Operational reporting, so the position across the marketplace, the loan book and the managed portfolio can be read in one place

Regulated from the start

The business operates as a registered fintech and regulated financial institution under Indonesian regulation, is a member of the national fintech association, and holds ISO 27001:2022 certification.

That last point is the part most worth noting. An information security certification is not something a platform acquires late by writing policies around whatever was built. It constrains how data is stored, how access is granted and revoked, and what evidence the system can produce. Those constraints were designed in, which is why they did not become a rebuild.

Why it mattered

The client is a lender, a marketplace and an asset manager in one company, so the technology had to serve three quite different operating rhythms without fragmenting into three disconnected systems. Getting those boundaries right early is what lets the platform keep absorbing new products, and it is the kind of decision a fractional CTO exists to make before it becomes irreversible.