Design a Personal Finance Aggregator

The ask

A user links bank accounts, cards and loans. The service shows one balance total and one transaction list across all of them.

Account aggregation means gathering account data from many providers into one place with the owner's permission. The service reads money data and never moves money.

Budgets group spending by kind. Alerts fire on large charges, low balances and due bills.

Trust is the product. A wrong balance or a leaked credential ends the relationship at once.

Estimate the scale

The service holds 20,000,000 users. Each user links 5 accounts.

20,000,000 users x 5 accounts = 100,000,000 linked accounts.

Every account is synced every 6 hours. That rhythm is 4 syncs a day per account.

100,000,000 accounts x 4 syncs = 400,000,000 syncs a day.

400,000,000 syncs / 86,400 seconds = 4,630 syncs per second.

Each sync is a conversation with a bank. The bank side, not the service side, sets the real pace limit.

API and data

The link operation takes a user and a bank choice. It returns a permission flow run by the bank, never a password form of the service.

The accounts operation takes a user. It returns every linked account with its latest balance and sync state.

The transactions operation takes a user, an account set and a date range. It returns transactions in time order with their groups.

An account record holds a user, a provider, a kind, a masked number and a balance with its time. Full account numbers never appear.

A transaction record holds an account, a date, an amount, a name and the bank's own transaction identity. The identity survives across syncs.

High-level design

A link service manages bank permissions. It stores access tokens in a vault, a hardened store that hands tokens only to sync workers.

A scheduler spreads syncs across the day. Staggering avoids a shared rush hour against every bank at once.

Sync workers fetch balances and new transactions per account. Each worker speaks one bank's format behind a common internal shape.

A grouping service labels transactions by kind. Labels come from merchant names and past user corrections.

App servers read stored balances and transactions. A user request never waits on a live bank conversation.

Deep dive: the sync rhythm

Banks limit how often an outside service may ask. The scheduler treats each bank's limit as a shared budget across all users.

Syncs ask only for changes since the last good sync. A short overlap window repeats a few transactions on purpose.

The overlap protects against a bank posting late. The stable transaction identity absorbs the repeats.

A user opening the app can request a fresh sync. The request joins the bank's budget instead of jumping every queue.

Failed syncs retry with growing gaps. A bank outage becomes a visible stale marker, not a silent wrong balance.

Deep dive: permission and safety

Modern banks grant a token after the user approves access at the bank. The service never sees or stores the bank password.

Tokens are read-only where the bank allows it. A read-only token cannot move money even if it leaks.

Access is logged per token use. A user can revoke a link, and revocation deletes the token and stops all syncs.

Balances show their sync time beside them. Old data says so, in the same place the number appears.

When a bank changes shape

A bank renames fields or moves a login step. Syncs for that bank start failing together.

Per-bank success rates make the break visible within minutes. One bank failing looks nothing like users failing one by one.

The connector for that bank gets fixed and tested against recorded shapes. Other banks stay untouched.

Users of the broken bank see a clear notice and their last good balances. Guessed data never fills the gap.

Evaluation and trade-offs

Scheduled syncs keep banks and budgets happy. The price is balances that can be hours old, shown with their age.

Per-bank connectors isolate change. The cost is one connector to maintain for every supported bank.

One honest view of all accounts is the core promise. A personal finance aggregator earns trust by showing stale data as stale, never as fresh.

Reading is separated from moving money by design. That boundary is the safety story users are asked to trust.

Scale at a glance