First, good luck - it's a difficult space and I applaud you for trying something different. I have a few uncorrelated questions:

1) Is the API limited to types of transactions or do you host configuration information? For example, I've often wished for a bank account that would look at my outgoings and some criteria that I've set, and then allocate some monies to savings or investments on a percentage basis rather than an absolute number. Are those calculations something I'd need to do at my end and then send you a bunch of API calls to make the transaction, or would they run as bots on your server? Sorry if that's not very clear

2) Will you impose tight or narrow restrictions on who can open accounts? For example in the USA many banks require an SSN to open an account and won't accept an ITIN (another kind of tax ID sometimes issued to immigrants), placing millions of people outside the banking system and thus making it that much more difficult for them to pay bills etc.

3) Will your service have access to the SWIFT network for international transfers or are you subject to restrictions while you prove some sort of banking bona fides? I don't know anything about banking relationships in South Africa or so but I've noticed the US is very aggressive about limiting transaction access for anything that looks like it could be remotely connected to crime of any kind, and I have sometimes had the impression that US banks are very 'suspicious' of anything that might coincidentally pose a threat to their business model.

I want to wish you a lot of luck and am very excited to see where this might go. I've never enjoyed dealing with money or finance, and get no more enjoyment out of being paid than I do out of paying bills. Financial chores are about as much fun as cleaning a toilet and the idea of being able to reduce the amount of time spent on dealing with money without putting myself at financial risk sounds heavenly.

Thanks :)

(1) A mixture of the two. We do allow you to write code that we host for you, to make prototyping (or building small features) easier and quicker, and you can access it all through the API, so you could do everything through a few https calls. (All account transactions are available to you)

(2) We try our best to make everything as seamless as possible, but we still have to comply with local regulations. We're working hard to create the best user experience possible given the tightly controlled environment we're in.

(3) That's part of the plan, yes :)

Hey - I previously worked on a prepaid debit platform that worked slightly farther from the metal here (post-processor).

I'm interested in two pieces of data we couldn't get there, but that I had really high hopes for.

1) Dynamic merchant-type filtering before auth. For example, if tom has spent 50$ on food this month, all merchants that identify as "food" will fail auth on further transaction attempts. I'm not sure if these are still called MCCs outside of the US, or "merchant codes".

2) Level 3/line item receipt data. For example, instead of showing I spent 5.00 at QuikEMart, it shows 2.50 on soda, 2.00 candy bar, 0.50 tax.

Will your platform offer that level of control/visibility?

Hey RickS, they are still called MCCs :) (2) is a bit more tricky to get our hands on, at least in South Africa

Cool - is MCC identifiable as part of the auth process, in the way my parent comment describes (conditional auth based on MCC)

Yeah, MCC and a bunch of other information on the merchant (name, location, etc)

I haven't seen any stack information yet (although I haven't checked the slack channel) what technologies are involved and how do you plan on mitigating the mass loads?

- for the stack was there specific criteria why certain languages where chosen in your use cases?

are there any API rate limits for clients?

are there any current plans on mitigating DDOS or other malicious attacks?

2016 has been a hard year for banks and hacking specifically the story about Bangladesh. The trend seems that this will become more likely as we move towards a full online infrastructure. For banking this is another layer where vulnerabilities can come up are there are plans in place for this?

> 2016 has been a hard year for banks and hacking specifically the story about Bangladesh. The trend seems that this will become more likely as we move towards a full online infrastructure. For banking this is another layer where vulnerabilities can come up are there are plans in place for this?

I'm not affiliated with Root, but the bank they are partnering with (Standard Bank of South Africa) was also hacked in 2016 and defrauded of R300 million ($16 million) via withdrawals from ATMs in Japan[1]. I'm sure they are acutely aware of the need for security.

1. http://city-press.news24.com/Business/standard-bank-r300m-fr...

Planning on going for corporate cards first? They'd eat this up -- directly enforce expense rules at the card. Maybe look for a buyout by concur :-)

Separately, looking to make this a platform for other vendors to issue cards? E.g., so another company can add logic for say, a teenager's card that the parents manage, and use your platform for this?

Shoutout from Canada! There are 32M of us, 88% of whom have internet. Our banks are archaic and expensive, and as a people, we have a low tolerance for that. My current bank actually believes that the telephony system is secure, compared to email :/

Our banking laws are favorable to startups; I could start my own bank, if I wanted to, for little more than the cost of a business license. Many merchants run their own little micro-banks, partly because of the aforementioned problem. Please help :)

- Do you have programmable international wire transfers in the works? That would be an instant sell to me. My current bank requires me to show up in person, and then verify the transfer by phone, both of which require making time out of a busy schedule.

- Do you have programmable virtual credit card numbers?

- Have you considered virtual bank account numbers as well? For example, I have had issues with organizations continuing to deduct from my account via ACH after stopping service. If I had a virtual bank account number that could be deleted, those rascals could be stopped in their tracks the moment I make the call saying "you are no longer authorized to deduct from my account". With the current system banks still let the unauthorized ACH transactions slide.

> Do you have programmable virtual credit card numbers?

Marqueta can do this. You can issue CC's via api, and then fund them with Visa direct. It's amazing.

https://www.marqeta.com/

Yeah, we are working on these types of things :)

> Do you have programmable international wire transfers in the works?

Unless things have changed recently, please watch out for the money laundering laws if you are in the USA. It is easier than you might think for absolutely innocent people to fall foul of them, making life miserable (speaking from experience).

https://edfine.io/blog/2015/12/20/how-bofa-froze-my-account-...

In which jurisdictions will this account be available? Just South Africa?

How far inside the bank do you APIs go? Do they deploy code you wrote or how are they providing the access? Did you build on top of some raw APIs? The hardest part of this businesses is probably that connection with the bank and I'm curious about what info you can share regarding that.

1) Is there any way to get the itemized receipt as part of the event information? (I don't even know if that's sent by the credit card widgets...)

2) What are your plans for supporting other languages? (cough Ruby cough)

3) How would I make a script integrate with a 3rd service?

Hi RangerScience, the APIs are based on REST, so any language that can handle https are supported. We're also working on libraries for a bunch of popular languages :)

I would like to volunteer writing bindings for Python.

I would like to volunteer writing binding for as many languages as you can come up with, but I can't guarantee I won't shave off a fraction of a cent in transactions. Or that I'll get the decimal placement right when dealing with that "fraction"...

In all seriousness, I would be fairly worried running someone else's code on my bank account unless it was very straightforward. Even forgoing malice and incompetence, there's plenty of "wow, that's a crazy interaction between systems that wasn't obvious" to go around.

What's the backend? How is my money secured and insured? Who actually underwrites the transactions?

The underlying banking infrastructure is provided by Standard Bank of South Africa

Does Standard Bank own a stake in Root, or do they just supply infrastructure/services?

Can this interact with FNB or ABSA accounts? Is it international? In short, what are the limits?

Also, I just want to say this is really cool. I've wanted something like this for ages.

From what I know the banking infrastructure are quite uniquely suited to each.

If I could incorporate, programmatically transfer money into a business account with as little friction or pain as possible, that would be helpful. I could then programmatically say, If billy's video got 5 likes, then transfer $50 to his account, etc... Seems like it could be a nice tool for a small digital business.

Do you have to be in South Africa for this? Or can I somehow use it in the US?

Random question but it really bugs me that FNB and I think most other South African banks still use SMS/Email based secondary authentication OTPs. Are you guys planning on using TOTP by any chance?

Hey spookyuser, yeah we do, i.e. Authy/Google Authenticator supported :)

Yay, thanks!

Just FYI: Capitec uses their mobile app for that (or you can also get a keychain with an authenticator).

Really? That's great. I didn't know that. FNB should get on it then. In general FNB seems to have 'poor' security. You can't even paste a password in when resetting or signing up. They seem to just want me to be making week passwords.

FNB also does OTP within their own mobile app.

It's not TOTP 2FA though right? I couldn't add it to authy if I wanted.

Do you charge for transactions? Is there a minimum amount for an account? Do you make money through standard banking methods?

Where does the code sit? Are you doing a callback when the authorization is triggered? How long do you wait for a response?

I'm assuming you're talking about RootCode? It's in a different secure environment (detached from our other systems) and unique to each user. The execution time is limited by the POS (point of sale) devices and varies

Would you describe your business model?

Any plans to back this with a blockchain of any kind?

There is essentially no point to using a blockchain if the only thing you're putting on it is an accounting system you have absolute control over anyway.

I think tech people vulnerable to buzzwordism have an instinctive response to respond to any mention of money with "blockchain!", even though it's really only useful in this context for decentralized payment systems (i.e. not for banks). The only place banks might want to use blockchains is for low-trust inter-bank settlement.

"Absolute control" would imply I can import javascript modules and interface with blockchains directly, so you're right that it wouldn't be Root's job to utilize the blockchain if I have this ability. There is nothing to indicate this is the case, however.

edit: if it is the case, I would be excited to see some docs

We're currently playing in the fiat currency space, but we are keeping an eye out for ways to merge the two

One beta user built a script that sells bitcoin in real-time as he swipes his card and tops up his fiat account, effectively making his card "spend bitcoin" :)

As far as the US IRS is concerned, every time he makes a purchase with bitcoin, it is a taxable event where he must declare any gains/loss from the time he purchased the bitcoin. This type of regulation is hindering BTC adoption in the US. BTC also doesn't solve any problems the average person has in a developed country, but that is another story..

that's so cool. have they open sourced this yet?

There is also this BTC debit card available, which could probably be used in conjunction with your service. https://www.shiftpayments.com/card

I'm curious, to what end?

As an extension to customizing your bank account. It'd be nice to be able to pull funds from cryptocoin accounts or make calls to smart contracts, etc. I'm thinking this could be the IFTTT of bank accounts, so I want to see as many connections as possible.

Well that makes sense, but not what I would call "backing it". I think the terminology confused me, integrating other accounts, etc. is a clearer target.

How many 'virtual' cards can a user have?

> 1337 1337 1337 1337 Erlich Bachman

Seems legit. Also, I hope that CC number on your top background image is flagged to never be handed out to a real customer ;)

Otherwise this looks promising. I hope to see something like this in the USA soon!

As another person suggested on this thread, I want to program my own fraudulent activity check. E.g. if someone buys something x miles from where I live.

Would that be possible with your API?

Your page shows a sample bit of code (the beforeTransaction function) that approves a transaction. Does MasterCard (or whoever) still run their approval magic before that?

What do you mean by their "approval magic"? There are other fraud filters etc built into various places throughout the payments system.

I think parent is referring to 3-D Secure (3DS). This is basically an authentication step which delegates most of its implementation to your bank (or whoever your credit card provider is).

I'm not sure what Standard Bank is doing with regards to 3DS, but it would certainly be neat if its implementation were programmable as well.

Yes, this more or less.

Did you guys write your own debit/credit card processor?

Is this usable in the United States?

On your main page you have two images of your card, probably worth making them the same.

Please come to Canada! I will cry of joy if this becomes available up here.