Build vs Buy ISO 20022 Payment Transformation and Enrichment Software
Community banks on a hosted core should buy, then press their provider hard on truncation defaults.
On this page
Community banks on a hosted core should buy, then press their provider hard on truncation defaults. Larger banks and payment service providers running more than one engine or core should own the transformation and enrichment layer, because deciding what data survives the trip into a legacy record is a banking product decision rather than a mapping exercise.
The institutions that should buy and stop
If you are a community bank or a credit union on a hosted core, and your core provider is delivering ISO 20022 readiness inside your existing licence, do not commission a payment hub. Your job is narrower and more useful: sit down with the provider and go through their default mapping field by field, then test with real corporate files rather than the samples they supply. Spend whatever budget exists on reconciliation and on training the operations team, because that is where the first three months after cutover will actually hurt.
Buying is also right when your payment volume runs on a single rail with a single engine and your payment products are undifferentiated. Volante Technologies and Bottomline both ship large message libraries with CBPR+ and high value payment usage guideline coverage, and that removes months of schema and validation work that has no competitive value whatsoever. Finastra makes sense when you have already committed to its payment engine. Form3 is a sensible bet for a challenger bank that is content to adopt someone else payment products and wants the rails run as a service.
The general principle is worth stating plainly. Nobody in this market wins business by writing better XML. If the messaging layer is plumbing to your institution rather than product, buy the plumbing, and put your engineering effort into the corporate channel experience where clients can actually tell the difference.
One caution for buyers in this bracket. Ask your provider what their defaults do with an ultimate creditor that differs from the creditor, and with structured remittance longer than your legacy field. The answer will be a product decision made on your behalf, and you should at least know what it is.
When the transformation layer should be yours
The build case rests on a single observation: a default has to do something, and what it does is truncate. A pacs.008 carries structured debtor and creditor party data, ultimate debtor and ultimate creditor, purpose codes, structured remittance with room for hundreds of characters, legal entity identifiers and structured postal address elements. Your core record was shaped around a legacy message with four lines of thirty five characters. Every place the two models meet, something gets decided, and in most banks nobody has written down what.
Own that layer when two or more of the following are true. You operate more than one payment engine or more than one core, so no single vendor product sits in the right place. Your transformation rules need to differ by payment product and by corridor, because a payroll file, a marketplace payout and a treasury sweep have different downstream consumers inside your own bank. You have corporate clients whose remittance data is the reason they bank with you, which makes losing it a commercial problem rather than a technical one. Or you are a payment service provider whose customers are themselves banks, in which case the transformation logic is the product.
Icon Solutions IPF deserves a specific mention here because its positioning is honest: it is a framework, it expects you to bring an engineering team, and the build cost does not disappear so much as move. That is a reasonable middle path when you want a payment processing skeleton without also buying somebody else product logic.
What each route really costs
Packaged payment hubs in this category are typically licensed with an annual fee in six figures for a mid sized institution, plus implementation services that commonly cost a multiple of the first year licence. Two pricing behaviours catch buyers out. Message library and usage guideline coverage is frequently licensed per market infrastructure, so adding a rail is a commercial event and not just a configuration. And where pricing is tied to transaction volume, the fee grows with your payments business rather than with your use of the transformation logic, which is the part that does not get harder as volume rises.
Custom work sits on a different curve. A first release comprising a canonical internal payment model, mapping for your two highest volume channels, an explicit truncation policy engine, a repair queue and shadow mode runs $90,000 to $220,000 and ships in 14 to 20 weeks. A full hub adding verbatim archive and lineage, the remaining channels, cash management reporting, screening integration and a phased cutover runs $250,000 to $650,000 across 9 to 18 months. Ongoing engineering and regulatory maintenance runs around a fifth of build annually.
The comparison that decides most business cases is neither of those numbers. It is the repair rate. Count the payments per day that currently fall out of straight through processing and the fully loaded cost of the operations staff clearing them, then estimate how many of those exceptions come from a party or remittance field that a better enrichment layer would have populated.
The costs that are not in the vendor proposal
The largest schedule risk is discovery on your own internal channels, and it is almost never budgeted. A corporate host to host feed whose enterprise resource planning (ERP) system has produced the same fixed width file since 2011. A teller application that builds a payment from twelve fields. A spreadsheet upload portal. An internal book transfer path that never produced a payment message at all and now has to. Each is a boundary where a rich canonical model must be constructed from thinner data, using your own customer master and reference data, and each is a separate elicitation exercise with a different business owner.
The second is sanctions screening behaviour after cutover. Names that arrived as a single concatenated blob now arrive as separate name, street, town and country elements, and a filter tuned against the old shape scores them differently. Good guy lists keyed on the previous normalisation stop firing. Budget shadow screening of both record shapes for a period, with a delta report per rule, so your financial crime team sees the change before a payment cutoff does.
The third is the deadline that actually governs the programme. Beyond the end of message coexistence, the industry has set a point at which unstructured postal addresses stop being acceptable on cross border payments in late 2026, which means your customer master and your address data quality, not your mapping code, become the critical path. Banks that started with mapping and left address remediation until later are the ones running late.
The fourth is a quiet one. A schema valid message can still be rejected by a market infrastructure because it breaches a usage guideline rule. Validating against the schema alone gives false confidence, and the rejections arrive in production.
A test that settles the argument in two weeks
Take two hundred real payments from last month, chosen deliberately rather than randomly: fifty from your busiest corporate client, fifty cross border, fifty from the teller or branch channel, fifty book transfers. Run each one through whatever transformation you have today, then compare the inbound message or file against the outbound message field by field.
Produce one list: every element present on the way in and absent or shortened on the way out. Against each, write which component made the decision and when the rule was authored. In most banks that second column cannot be completed for a meaningful share of the list, and that gap is the finding.
Then ask a different question of the same two hundred. For how many can you retrieve the exact bytes you received and the exact bytes you sent, rather than your interpretation of them stored in the core. If the answer is low, an investigation two years from now becomes an archaeology project, and no vendor demonstration will change that.
How to sequence it and what to demand
Whichever way you go, author the truncation policy first, per payment product and per corridor, and have your payments product owner sign it rather than your architect. That document is the real deliverable of an ISO 20022 programme, and software is only the thing that enforces it.
In evaluation, put a real pacs.008 with an ultimate debtor, structured remittance and a hybrid address in front of the team and ask them to walk it into your core record. A team that has done this asks about your core layout within five minutes. Ask how they will prove new logic correct before it touches a rail, and if replaying recorded production traffic and diffing outputs is not in the answer, they intend to test in your payment flow. Ask what they have built on the reporting side, since consuming cash management statements and returning reject statuses to the originating channel is where programmes quietly fail.
Digital Heroes will not open an editor before that document exists, which in payments means truncation and mapping rules get argued while they are still cheap. Over two thousand projects delivered, a team past fifty people, Fiverr Vetted Pro status, and UK, US and Indian entities available to sign, so a regulated institution keeps both the contract and the intellectual property assignment inside its own jurisdiction. Its YouTube channel carries 2.5 million subscribers and is a quick read on how the team handles technical explanation.
Last point, and it is the one to put in the contract. You own the repository, the mapping definitions in a readable format and the cloud accounts. Mapping rules are the accumulated policy of your payments business, and a vendor holding them in a proprietary format has taken custody of that policy.
If you would rather someone argued with your brief than agreed with it, Digital Heroes writes a product requirements document before any code exists, so the scope is fixed and priced rather than discovered later at a day rate. You can take that specification to any other firm on your shortlist.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- Retailers improving Core Web Vitals saw measurable gains: Vodafone improved LCP by 31% for 8% more sales, Lazada saw a 16.9% mobile conversion increase, and Cdiscount saw a 6% Black Friday revenue uplift. Source: web.dev (Google Chrome team) (2021) →
- Technical debt is the number-one frustration at work for professional developers, cited by about 63% of respondents - roughly twice the rate of the next-most-common frustration (complexity of tech stack, ~33%). Source: Stack Overflow (2024) →
- WordPress powers 41.5% of all websites and holds 59.2% of the market among sites running a known content management system, making it by far the most-used CMS on the web. Source: W3Techs (2026) →
- Acquiring a new customer is five to 25 times more expensive than retaining an existing one, and research by Frederick Reichheld of Bain & Company found that increasing customer retention rates by 5% increases profits by 25% to 95% - underscoring the ROI of support that keeps customers. Source: Harvard Business Review / Bain & Company (2014) →
Frequently asked questions
How much does ISO 20022 transformation software cost to build?
A first release covering a canonical payment model, mapping for your two busiest channels, a truncation policy engine, a repair queue and shadow mode runs $90,000 to $220,000 across 14 to 20 weeks. A full hub with archive, lineage, remaining channels and phased cutover runs $250,000 to $650,000 over 9 to 18 months. Channel count and core flexibility drive both bands.
How long does an ISO 20022 migration take end to end?
Fourteen to twenty weeks for a first release on your highest volume channels, and nine to eighteen months for a full multi channel hub with dual running. The schedule risk sits in discovery on internal channels such as teller, host to host uploads and book transfers, where available data is thinner than the standard assumes. Address data remediation frequently becomes the critical path rather than mapping.
How do we migrate historical payment data and archives?
Do not convert history. Keep legacy archives readable in their original format for the full retention period and store new traffic verbatim on both sides of the transformation, with lineage between them. An investigation asks what arrived, what you sent and what changed in between, and a converted archive answers none of those cleanly. Plan the retrieval interface, not the conversion.
Which integrations cause the most trouble in a payments build?
Sanctions screening and cash management reporting. Screening shifts because structured name and address elements score differently in a filter tuned on concatenated strings, so run both record shapes in shadow with a delta report per rule. Reporting fails quietly because consuming statements and returning reject statuses to the originating channel is treated as a phase two item and then never funded properly.
What team do we need in house to run this after go live?
Fewer people than a payment engine requires and more discipline. You need one payments product owner who authors truncation policy per product and corridor, an analyst who can read and change mapping definitions, and operations staff trained on the repair queue with the rail deadline visible. Engineering support can be contracted, but policy ownership cannot be outsourced without the rules drifting.
Who actually builds ISO 20022 transformation layers?
Specialist payment vendors, a few consultancies, and custom firms with regulated delivery behind them. Digital Heroes fits institutions that want mapping and truncation rules held in a readable repository they own rather than a proprietary scripting format, with the option of signing under British, American or Indian law. Procurement can verify the Fiverr Vetted Pro listing and a delivery history running past two thousand projects.
What makes Digital Heroes different for payment message work?
The rules are written down and approved before code exists, and they stay in a repository you own in a readable form. In payments the expensive mistake is a truncation decision nobody authored, so making that decision reviewable by a product owner rather than buried in vendor scripting is the actual differentiator. Three products of its own, ShopScore, HeroCheckout and Section Vault, are built and operated by the same team.
How do we verify a development partner before signing?
Take the D-U-N-S number and confirm the registered company is the one on the draft contract. Read Clutch and Trustpilot for entries naming real institutions rather than initials. Establish which entity signs and under which law, because that decides your remedy. Ask for a reference from another regulated client. Then secure ownership of the repository, the mapping definitions and the cloud accounts before kickoff.
What does it cost to keep custom software running after launch?
Budget 15-20% of the original build cost per year, which on a $100,000 system means $15,000 to $20,000 for security patches, dependency updates, bug fixes, and small improvements as real usage reveals what the spec missed. Cloud hosting for a typical business application adds $50 to $300 a month on top. Skipping maintenance does not save the money; in Digital Heroes rescue work, unmaintained systems typically need a far more expensive rebuild within about three years.
What are the biggest mistakes first-time software buyers make?
Choosing the lowest bid, paying more than 30-40% upfront instead of on milestones, skipping a written specification, and having no maintenance plan for after launch. The most expensive of the four in Digital Heroes rescue projects is the missing spec: without written acceptance criteria, done becomes an argument instead of a checklist, and every disagreement resolves in the vendor's favor. Fix those four and you have avoided most of the ways these projects fail.
What does a $50,000 custom software budget actually buy?
One core workflow done properly: 10 to 15 screens, two or three user roles, a couple of integrations, an admin panel, and automated tests, delivered in roughly 12 to 14 weeks. What it does not buy is that workflow plus a mobile app plus AI features plus five more integrations. The discipline of picking the one workflow that matters is what separates $50,000 projects that ship from $50,000 projects that stall at 70% complete.
What should I have ready before I contact a development agency?
Three things, none of them technical: a one-page description of the problem in your own words, a list of the tools and spreadsheets the new system must replace or connect to, and a must-have versus nice-to-have split of features. Add a budget range, even a wide one, because it changes the conversation from fantasy to engineering. You do not need a formal specification; producing that is what a discovery phase is for.
We run everything on Airtable and spreadsheets. When is it time to go custom?
The switch usually makes sense when you hit one of two walls: Airtable's record caps (125,000 records per base on the Business plan) or logic the tool cannot express, like multi-step approvals with conditional pricing. There is also a simple cost signal: 25 people on Business at roughly $45 per seat per month is about $13,500 a year, forever, for a tool you are already fighting. Custom is worth it when the workflow is core to how you make money; for peripheral processes, staying on Airtable is the right call.
How do we get years of data out of our old system and into the new one?
Treat migration as a planned sub-project: a field-mapping document, at least one dry run on a copy of your data, then a cutover with the old system kept read-only for 30 days as a safety net. On Digital Heroes projects it consumes 10 to 15% of the budget when the old system has an export, and more when data must be pulled out screen by screen. Ask any vendor to walk you through their last migration before you sign.
If an agency builds my software, who actually owns the code?
You should own everything, assigned in writing: the contract transfers full IP to you on final payment, the code lives in your GitHub organization, and hosting runs in cloud accounts you control. The red flag is a proposal that mentions the agency's proprietary platform or framework, which usually means you are renting, not buying. Digital Heroes structures every build this way precisely so a client can fire us and lose nothing but the relationship.
Should we build an MVP first or go straight to the full system?
MVP first, for almost everyone: ship the single workflow that carries the business value in 10 to 16 weeks, learn from real users, then fund phase two from evidence instead of guesses. The caveat is that an MVP is a small version of a well-built system, not a badly built version of a big one; the data model must already support what comes next. An agency that cannot tell you what they deliberately left out of your MVP has not designed one.
Will custom software work with the tools we already use, like QuickBooks and Stripe?
Yes, and this is one of custom software's genuine advantages: QuickBooks, Stripe, Shopify, and most mainstream business tools publish documented APIs built for exactly this. Expect each standard integration to add one to two weeks of build time, and be suspicious of any quote that lists five integrations without asking what data flows in which direction. The hard cases are legacy systems with no API, which is a question to raise in discovery, not in week nine.
Who can build a custom software system?
Digital Heroes builds custom software systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other software companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
Related guides
More from Beau.
Performance Marketing Manager · APAC · Sydney · 1 post on the site
Published · Last updated .
