How to read
Reading this document
Each feature group describes a user-facing area of the app. Flow sections describe the sequence of screens in order. Acceptance criteria define when the feature is done. Screen IDs (e.g. ONB-004) match the v0.4 wireframe flows.
What changed from v0.3 → v0.4
- Onboarding expanded from 6-step to 12-step form (added AML/compliance fields)
- Veriff GuidedID KYC flow fully specified (ONB-W01 → ONB-W11)
- Country code picker (ONB-007b) added
- Card model clarified: virtual-first, ATM-only physical activation, same CPAN
- Activate Card simplified: one-tap + biometric, no PAN entry for virtual
- Add to Apple / Google Wallet given dedicated screen (WAL-009)
- Card Limits redesigned as dual circular gauges + Card Limit toggle
- Order Physical Card includes in-app PIN setup + ATM activation note
- Send & Pay (FLOW 07) — new: UK Bank Transfer + International Transfer
- Bottom tab bar added across all settled destination screens
Onboarding Updated
Takes a new user from app download to funded account with an activated virtual Visa debit card. The flow should feel like joining a fan club that happens to come with a bank account — not filling in a banking application form. The 12-step form collects identity and compliance data progressively.
Welcome ONB-000 → ONB-002
| ID | Screen | Key details |
|---|
| ONB-000 | Splash screen | Tempo logo on white. Animated loading arc (pie-style). Background may be brand photography. |
| ONB-001 | Welcome | Tempo logo + "Engineered for Motorsport Culture" slogan. Two CTAs: "I'm new here!" → onboarding; "Log In" → keycode screen. |
| ONB-002 | Log In | 6-digit keycode keypad. User avatar shown top. Grants access to Wallet Home (WAL-001) or appropriate wallet state. |
Choose Your Card ONB-003
| ID | Screen | Key details |
|---|
| ONB-003 | Card Selection | Three tiers: Everyday (£4.99/mo), Plus (£6.99/mo), Premium (£89.99/yr). Swipe left/right between cards. No default selection — user must actively choose. Scroll down for full benefits. Select button at bottom. |
The 12-Step Form ONB-004 → ONB-011 Updated — was 6 steps
The form now collects 12 data points to satisfy AML/KYC compliance requirements. A progress bar (1/12 → 12/12) tracks position. Each step uses the full-screen keypad or form pattern.
| ID | Step | Screen | Key details |
|---|
| ONB-004 | 01/12 | Your Name | Fields: Given name(s), Surname, Preferred Name (optional). Helper: "as it appears on your photo ID". Min 2 chars per field. |
| ONB-005 | 02/12 | Email | Email + confirm email. Standard format validation. |
| ONB-006 | — | Verify Email | 6-digit code in individual digit boxes. Racing car illustration + "GOTTA CHECK YOUR INBOX!". Resend code link. Auto-advances on valid entry. |
| ONB-007 | 03/12 | Mobile Number | Phone field with country code prefix (+44 default). Keypad for input. Tapping +44 opens country code picker sheet. |
| ONB-007b | — | Country Code Picker New | Bottom sheet overlay. Search field + scrollable list of countries with flag, name, dial code. UK pre-selected. |
| ONB-008 | 04/12 | Keycode Creation | Lock It: create 6-digit keycode. Secure It: confirm (re-enter). Must differ from device passcode. Becomes fallback auth. |
| ONB-009 | — | Biometric Setup | Face ID prompt (fingerprint variant for Android). "Enable now" or "Enable later". If enabled, becomes primary auth; keycode is fallback. |
| ONB-010 | 05/12 | Date of Birth | DD/MM/YYYY input. Keypad pops up on tap. Must be 18+. |
| ONB-010a | 06/12 | Nationality New | Country selector (searchable list). Used for AML risk scoring. |
| ONB-010b | 07/12 | Market New | UK or EU selection. Determines regulatory jurisdiction and card product. |
| ONB-010c | 08/12 | Purpose of Account New | Multi-choice: Personal spending, Travel, Motorsport events, Business expenses, Other. AML requirement. |
| ONB-010d | 09/12 | Source of Funds New | Multi-choice: Employment, Savings, Business income, Investments, Other. AML requirement. |
| ONB-010e | 10/12 | Monthly Transactions New | Expected monthly spend range (£0–£500, £500–£2k, £2k–£10k, £10k+). Pill selector. |
| ONB-010f | 11/12 | Annual Transactions New | Expected annual turnover range. Pill selector. Feeds into EDD triggers. |
| ONB-011 | 12/12 | Address | Postcode lookup → address list. Confirm button to proceed. |
Identity Verification (KYC) ONB-012 → ONB-020 Updated — Veriff GuidedID
KYC is handled via Veriff GuidedID. The app submits form data, then hands off to Veriff's mobile browser for document capture and liveness check. The flow is split into sub-groups: in-app screens, Veriff-hosted screens (labelled ONB-W*), and re-login status screens.
⚠ Veriff-hosted flow note
- Screens ONB-W01 → ONB-W11 are hosted by Veriff in a mobile web browser — Tempo does not control their exact layout or copy
- They can be branded under the Tempo name and colour scheme
- The document type screen (ONB-W07) is shown only if Veriff cannot auto-detect the document — it is a fallback, not the default path
- Scan Back (ONB-W08) is only shown for documents with a reverse side (e.g. driver's licence)
| ID | Screen | Key details |
|---|
| ONB-012 | Submit & Processing | In-app. Form data submitted to Equals API. Progress animation while KYC check runs. |
| ONB-013 | KYC Success | In-app. "Identity verification complete!" celebration. Proceeds to Initial Payment. |
| ONB-014 | KYC Failure | In-app. Clear failure messaging. Link to PITStop support. Option to retry. |
| ONB-015 | Veriff Handoff | In-app. QR code + SMS link to open Veriff in mobile browser. Desktop holding screen shown. |
| ONB-W01 | Veriff Landing Veriff-hosted | Welcome screen in Veriff browser session. Tempo-branded. Lists what user will need (ID + selfie). |
| ONB-W02 | Camera Permission | Request camera access before document capture begins. |
| ONB-W03 | Connected to Mobile | Desktop screen shown when user switches to mobile. "Connected to your phone" holding state. |
| ONB-W04 | Intro to Capture | Instructions before document scan. "Have your ID ready." |
| ONB-W05 | Scan Front | Camera view with overlay frame. User aligns ID front face. Auto-captures when aligned. |
| ONB-W06 | Scan Back (conditional) | Only shown for documents with a reverse side. Same camera overlay pattern. |
| ONB-W07 | Document Type (fallback) | Shown only if Veriff cannot auto-detect. Three options: Passport, Driver's Licence, National ID. |
| ONB-W08 | Selfie | Liveness check. User faces camera. Animated guide ring. Auto-captures. |
| ONB-W09 | Please Wait | Processing spinner while Veriff analyses captures. |
| ONB-W10 | Submitted | Confirmation that submission is complete. User can close browser and return to app. |
| ONB-016 | Pending (re-login) | Post-KYC re-login state: application submitted, awaiting review. Not yet approved. |
| ONB-017 | Approved (re-login) | Post-KYC re-login: approved. Proceeds to card activation or wallet home. |
| ONB-018 | Rejected (re-login) | Post-KYC re-login: rejected. Clear messaging + PITStop link. |
| ONB-019 | Incomplete (re-login) | Post-KYC re-login: KYC not yet started or incomplete. Relaunches Veriff handoff. |
Final Touches ONB-015 → ONB-018
| ID | Screen | Key details |
|---|
| ONB-015 | Initial Payment (Kickstart) | "Provide card details. Kickstart." Notice about monthly fee deduction. Payment options: Credit, Direct Debit, Apple Pay, Google Pay. "Pay Now" disabled until option confirmed. |
| ONB-016 | Add to Wallet | Branded virtual card shown. "Add to Apple/Google Wallet" + "Later" skip link. |
| ONB-017 | Legal Agreements | "You're almost at the finish line!" Two checkboxes: Terms of Service + Privacy Policy. Scrollable terms card. Both must be checked to proceed. "Agree" button. |
| ONB-018 | Finished! | "Welcome to Tempo!" "Go Home" button → Wallet Home (WAL-001). |
Acceptance criteria — Onboarding
- Users progress from welcome to completion through a clear linear flow with correct navigation at every step (including login vs new user paths)
- Users must select a card plan before continuing — no default selection, clear pricing visible
- All 12 form steps validate correctly before allowing progression
- Email verified via 6-digit code; resend functionality available
- Authentication set up (6-digit keycode, optional biometrics); keycode confirmation enforced
- AML fields (nationality, market, purpose, source, monthly/annual estimates) all collected and submitted
- Country code picker opens as bottom sheet; defaults to UK (+44)
- KYC handoff to Veriff completes successfully; success/failure/pending states handled on re-login
- Initial payment processed before account activation; Pay Now disabled until valid method selected
- Legal agreements accepted; both checkboxes required before proceeding
Open Questions
- What's the maximum time a half-completed application can be resumed before data is cleared? (30 days? 90?)
- If Veriff rejects the user, can they re-attempt immediately in-app, or is there a cool-off period?
- Do we need a "Why do we ask?" tooltip on every AML field, or only the most contentious ones (income estimates)?
- Should the 12-step form collapse to fewer screens for returning Tempo users (e.g. re-activating a closed account)?
- What happens if the user's device browser is unavailable for the Veriff handoff (private mode, no default browser)?
Integration Notes
- Veriff builds the entire ID verification web flow (QR/SMS handoff, document scan, selfie, liveness). Tempo receives webhook on completion.
- Equals Money creates the user account on Veriff success; returns user ID, card status, initial ledger.
- Tribe builds the 12-step form, initial-payment screen, Apple Wallet push, legal agreement capture.
- Email/SMS verification codes can be handled by Equals or a dedicated OTP provider (TBD).
Wallet
The app's home screen. Shows balance, card, and recent activity. Every session starts here. Should feel like opening a wallet — immediate, clear, trustworthy.
Wallet Home (WAL-001)
├── Card image → Card Details (WAL-012)
├── Balance (WAL-003)
├── Card Controls button → Card Controls Hub (WAL-008)
│ ├── Add to Apple/Google Wallet (WAL-009)
│ ├── Activate Virtual Card (WAL-010)
│ ├── Order Physical Card (WAL-013) → Order Flow
│ ├── Report Card Issue (WAL-014)
│ ├── Limits & Controls (WAL-015)
│ └── Freeze/Unfreeze toggle (WAL-011)
├── Add Funds button → Add Money (WAL-006)
│ └── Account Details overlay (WAL-007)
├── Send button → Send & Pay (PAY-001)
├── Latest Transactions → Full History (WAL-005)
└── Ecosystem Highlights carousel (WAL-018)
Wallet Home States WAL-001 → WAL-004
| ID | Screen | Key details |
|---|
| WAL-001 | Home · Default | Header: profile avatar + "Hi [name] / Welcome back". Balance large and prominent. Card image (tappable → WAL-012). Three quick-action buttons: Card Controls, Add Funds, Send. Latest 3–5 transactions. Ecosystem carousel below. |
| WAL-001 | Home · Frozen | Card darkened with frost overlay. "❄ FROZEN" badge. Freeze toggle accessible here and from Card Controls. |
| WAL-001 | Home · Empty | "No transactions… yet" with coin illustration in transaction area. |
| WAL-018 | Ecosystem Highlights | 1–3 dynamic cards below transactions. Content: reward unlocks, event incentives, limited offers, VIP tier recognition. Each card tracks impressions, tap-throughs, conversions. Content from remote config/API. |
Acceptance criteria — Wallet
- Balance updates within 5 seconds of a transaction or top-up
- Card image reflects the user's partner theme (Tempo yellow)
- Ecosystem carousel loads within 2 seconds of wallet home appearing
- Freeze/unfreeze takes effect immediately and is reflected in card image
- All monetary amounts in GBP with comma separators and two decimal places
- Merchant logos load from logo service; graceful fallback to merchant initial if not found
Open Questions
- How many recent transactions fit on the wallet home — fixed 3, fixed 5, or responsive based on viewport?
- Does the Ecosystem carousel show different content per tier (Plus gets early access, Premium gets exclusive drops)?
- Should tapping a merchant avatar open the merchant's detail page (offers, past spend) or just that transaction?
- Do we show a "Next bill due" line item for subscription users on wallet home, or keep that in Settings?
- What's the refresh strategy — pull-to-refresh only, silent background polling, or push-triggered?
Integration Notes
- Equals Money — balance endpoint (polled on foreground + after every user action), transaction feed (websocket or poll).
- Merchant logo service — TBD; options include Clearbit, Plaid Enrich, or a custom lookup. Fallback to first letter of merchant name.
- Ecosystem content CMS — remote config delivers carousel slots; supports targeting by tier, geography, campaign window.
- Push notifications (Firebase / APNs) — balance change, incoming transfer, card transaction, freeze events.
- Tribe builds — all UI, state management, offline caching, skeleton states.
Transactions
Full transaction history with search and date filter. Pending and completed sections with running balances per date group.
Transaction History WAL-005
| ID | Screen | Key details |
|---|
| WAL-005 | History · Default | Header: 🔍 search icon (left) + "Transactions" title + × close (right). Pending section + Completed section. Running balance shown per date group. 3–5 rows visible without scroll. |
| WAL-005 | Empty State | "No transactions… yet" illustration in transaction area. |
| WAL-005 | Search Expanded | Search bar expands to cover date filter button. Results narrow as prompt becomes more specific. "Cancel" text button to dismiss. |
| WAL-005 | Date Filter Open | Calendar picker expands with date range inputs (from/to) and month grid. Tap range on grid or type manually. "Apply filter" button. |
Add Funds
Two ways to top up: card/digital wallet (instant) or bank transfer (copyable account details). Triggered from the "Add funds" quick action on Wallet Home.
Add Money WAL-006 → WAL-007
| ID | Screen | Key details |
|---|
| WAL-006 | Add Money · Pick | Two methods: Card or digital wallet (instant) · Bank transfer (1–2 hrs). Each as a large tappable row. |
| WAL-006 | Card · Payment Method | Bottom sheet. "Payment Method" header. "Funds arrive instantly." Options: Apple Pay, Google Pay, Visa, Mastercard. |
| WAL-007 | Bank Transfer Details | Bottom sheet. Account name, account number (with copy), sort code (with copy). Close × to dismiss. |
Card Controls Updated
Central card management hub. Users start with an unactivated virtual card — activation is one-tap with biometric, no PAN entry required. Freeze/unfreeze, view secure details, PIN reveal (physical only), report issues, allowances and limits.
Card model — Virtual vs Physical
- Virtual card — issued unactivated to every user at signup. Activation = one-tap confirm + Face ID. No PAN digits required. Once active, usable for online payments and Apple/Google Pay immediately.
- Physical card — optional (£4.99 inc. delivery). Ordered via app. PIN set in-app during ordering (entered twice). Physical card arrives inert; activation happens automatically on first successful ATM transaction using the PIN. No in-app activation step needed.
- Same CPAN — virtual and physical share one card number. Physical card may have a different expiry date. Once the physical card is ATM-activated, the virtual card ceases to exist.
Controls Hub WAL-008
| ID | Screen | Key details |
|---|
| WAL-008a | Hub · Virtual (unactivated) | Card shown at top. "Virtual · Not active" badge. Activate Virtual Card is highlighted primary CTA. Other options greyed until activation. |
| WAL-008b | Hub · Virtual (active) | Full hub. Actions: Add to Apple Wallet, Order Physical Card, View card details, Report issue, Allowances & Limits, Freeze toggle. |
| WAL-008c | Hub · Physical (active) | Order Physical Card removed. View PIN appears. Otherwise same as WAL-008b. |
Activate Virtual Card WAL-010 Updated — no PAN entry
| ID | Screen | Key details |
|---|
| WAL-010a | Activate · Intro | Card shown. Explains virtual card activation. Single "Activate now" CTA. |
| WAL-010b | Activate · Biometric | Face ID / keycode gate. No PAN entry required. |
| WAL-010c | Activated ✓ | Success. "Your virtual card is ready." CTA: Add to Apple Wallet. |
| WAL-010d | Activation Failed | Error state with retry option. |
Add to Apple / Google Wallet WAL-009 New dedicated screen
| ID | Screen | Key details |
|---|
| WAL-009 | Add to Wallet | Card shown. Explanation copy. Dark native-OS provisioning placeholder sheet. iOS: PKAddPassesViewController. Android: Google Wallet API push provisioning. Tempo has no control over exact native sheet UI. |
Freeze / View Details WAL-011, WAL-012
| ID | Screen | Key details |
|---|
| WAL-011 | Freeze Confirm | Freeze toggle accessible from hub and wallet home. Instantly blocks all transactions. Push notification sent. Card UI shows frost overlay + "FROZEN" badge. |
| WAL-012 | View Card Details | Biometric / keycode gate before display. Shows: Name on card, Full PAN, Expiry, CVV — each with copy button. Security notice: "keep these private." |
| WAL-012b | PIN Reveal (physical only) | "View my PIN" button in WAL-012. Additional biometric confirm. Displays PIN momentarily. Physical card only — virtual has no PIN. |
Limits & Controls WAL-015 Updated — circular gauges
| ID | Screen | Key details |
|---|
| WAL-015 | Limits & Controls | Two circular donut gauges: Daily Limit (e.g. £320/£2,000 spent, resets midnight UTC) and Per Transaction Limit (e.g. £85/£500). Amount remaining shown in centre of each gauge. Period displayed below. Single "Card Limit" On/Off toggle below gauges. Limits set by Equals/compliance — user cannot edit values. |
Report Card Issue WAL-014
| ID | Screen | Key details |
|---|
| WAL-014 | Report Card Issue | Issue types: Lost my card, Card was stolen, Damaged card, Unrecognised transaction. Lost/Stolen → freezes card instantly + opens PITStop support ticket. |
Order Physical Card WAL-013 Updated — includes PIN setup
| ID | Screen | Key details |
|---|
| WAL-013a | Order · Pay | Virtual card + balance shown. Card cost: £4.99 inc. delivery. Options: pay via another card or add funds to purchase. |
| WAL-013b | Confirm Address | Pre-filled delivery address from registration. Confirm or change. |
| WAL-013c | Change Address | Postcode lookup → address list. Same pattern as ONB-011. |
| WAL-013d | Set PIN · Intro New | Education screen. Avoid: 1234, 0000, birth year, obvious sequences. |
| WAL-013e | Set PIN · Enter New | 6-digit keypad. Step 1 of 2. |
| WAL-013f | Set PIN · Confirm New | Re-enter to confirm. Step 2 of 2. |
| WAL-013g | Set PIN · Mismatch New | Error if PINs don't match. Re-enter from step 1. |
| WAL-013h | Order Placed | Celebration screen. Expected delivery date shown. Delivery: 5–7 working days. |
| WAL-013i | Card Arrived · Awaiting ATM New | Post-delivery state. "Insert your card at any ATM and enter your PIN — activation is automatic." No in-app action needed. |
| WAL-013j | Physical Activated (push) New | Push notification confirmation. "Your physical card is now active. Your virtual card has been retired." Apple Pay tokens updated automatically. |
Acceptance criteria — Card Controls
- Virtual card activation requires biometric/keycode only — no PAN digits
- Card details screen requires biometric or keycode before displaying PAN, CVV, PIN
- Freeze/unfreeze takes effect immediately; push notification sent on each action
- Physical card order deducts £4.99 from balance or charges selected payment method
- PIN set in-app during order (two matching entries required); mismatch returns to step 1
- Physical card activates on first successful ATM transaction; no in-app step required
- Once physical card activates, virtual card is retired (same CPAN cannot exist in two places)
- Apple/Google Wallet provisioning follows platform-specific guidelines
- Card Limit toggle requires confirmation modal before disabling
Open Questions
- If the user reports a physical card as lost and a replacement is issued, does the virtual card reactivate in the interim, or stay retired?
- What happens to a pending Apple Wallet token when a physical card activates and retires the virtual card — auto-refresh, or does the user re-provision?
- Should PIN reveal have a daily reveal cap (e.g. max 3 views/day) to discourage screen-recording attacks?
- Is the £4.99 physical card fee a one-off or per-replacement? Are first-year upgrades free?
- Do we offer a metal card variant for Premium tier, and is that a separate SKU or just a cosmetic choice at order time?
Integration Notes
- Equals Money — virtual card issuance, activation, freeze/unfreeze, PAN/CVV/PIN retrieval (all responses short-lived, no caching).
- Card manufacturer / fulfilment (TBD — via Equals?) — physical card printing, PIN mailer, delivery tracking.
- Apple Wallet — PKAddPassesViewController + PKPass push provisioning API.
- Google Wallet — push provisioning SDK; tokenised Visa card object.
- Tribe builds — controls hub UI, biometric gating, freeze/unfreeze UX, order physical card flow, PIN setup, limits & gauges.
Send & Pay New
Two bank transfer rails: UK Faster Payments and International (SWIFT/SEPA). Triggered from the "↑ Send" quick action on Wallet Home. Biometric confirmation required before funds move.
Send & Pay Hub (PAY-001)
├── UK Bank Transfer
│ ├── PAY-002 Recipient details (sort code + account number)
│ ├── PAY-003 Amount entry (keypad)
│ ├── PAY-004 Review & biometric confirm
│ └── PAY-005 Success ✓
└── International Transfer
├── PAY-006 Recipient details (IBAN + BIC/SWIFT + country)
├── PAY-007 Currency & amount (live FX rate shown)
├── PAY-008 Review & biometric confirm
├── PAY-009 Processing
└── PAY-010 Success ✓
Error states (both rails):
PAY-011 Insufficient funds → Top up CTA
PAY-012 Transfer failed → PITStop support
Send Hub PAY-001
| ID | Screen | Key details |
|---|
| PAY-001 | Choose Transfer Type | Available balance shown prominently. Two large CTA rows: UK Bank Transfer (Faster Payments · 2 hrs · Free) and International Transfer (SWIFT/SEPA · 1–3 days). |
UK Bank Transfer PAY-002 → PAY-005
| ID | Screen | Key details |
|---|
| PAY-002 | Recipient Details | Fields: Account name, Sort code (auto-formats with dashes), Account number, Reference (optional). |
| PAY-003 | Enter Amount | Recipient name + sort code shown at top. Large keypad amount entry. Max available balance shown. |
| PAY-004 | Review & Confirm | Summary: to, amount, reference, arrival time (within 2 hours · Faster Payments). Biometric/keycode confirmation required to send. |
| PAY-005 | Transfer Sent ✓ | Celebration screen. Amount + recipient confirmed. Push notification sent. |
International Transfer PAY-006 → PAY-010
| ID | Screen | Key details |
|---|
| PAY-006 | Recipient Details | Fields: Recipient name, Country (selector → determines IBAN/SWIFT requirement), IBAN, BIC/SWIFT code, Reference (optional). |
| PAY-007 | Currency & Amount | Two-panel: "You send (GBP)" + "They receive (EUR/local currency)". Live FX rate shown with fee. Rate locks for 30 seconds. Keypad input. |
| PAY-008 | Review & Confirm | Full breakdown: to, IBAN, you send (+ fee), they receive (in local currency), FX rate, arrival time. Biometric/keycode confirmation required. |
| PAY-009 | Processing | Spinner while transfer submits. Auto-advances to success or error. |
| PAY-010 | Transfer Sent ✓ | Celebration. GBP amount + recipient + local currency amount + arrival estimate. Push notification sent. Reference number visible in transaction history. |
Error States PAY-011 → PAY-012
| ID | Screen | Key details |
|---|
| PAY-011 | Insufficient Funds | Shown before confirm screen if balance too low. Shows required vs available amount. "Top up now" CTA → Add Funds flow. "Cancel" to dismiss. |
| PAY-012 | Transfer Failed | Generic failure. Funds never debited. "Try again" + link to PITStop support. |
Acceptance criteria — Send & Pay
- Both UK and international transfer rails accessible from wallet home "Send" quick action
- UK transfers use Faster Payments; arrive within 2 hours
- International transfers use SWIFT/SEPA; arrive within 1–3 working days
- FX rate displayed before confirmation; rate locks for 30 seconds on confirm screen
- Fee displayed clearly alongside send amount before confirmation
- Biometric or keycode confirmation required before funds are debited
- Insufficient funds check runs before confirm screen; CTA routes to Add Funds
- Transfer reference number visible in transaction history after successful send
- Push notification sent on successful transfer
- Failed transfers never debit the user's account
Open Questions
- Do we keep a recipient address book from v1, or defer to v2?
- How long does the locked FX rate persist if the user hesitates on the Confirm screen? (currently 30s — need FX provider input)
- Do we support sending to a user's own external bank account as a distinct flow ("withdraw") with different messaging?
- What's the maximum single-transaction limit — regulatory or product-defined?
Integration Notes
- Equals Money — Faster Payments (UK) and SWIFT/SEPA (international) rails. Equals returns a transfer ID used as our reference.
- FX provider (TBD — likely Equals or a partner) — live rate API, rate locking, fee calculation.
- Tribe builds — entire send UX, validation, confirmation screens, error handling, push triggers.
Settings & Profile New
Account management hub opened from the hamburger (≡) on the Wallet home. Covers personal details, security (biometric, keycode, active sessions), notification preferences, subscription tier, PITStop support, legal documents, and account closure. Every edit is biometric-gated. Destructive actions are double-confirmed.
Profile Hub (SET-001)
├── Personal Details
│ ├── SET-002 View (name, email, phone, address)
│ └── SET-003 Edit email/phone/address → biometric → verification code
├── Security
│ ├── SET-004 Hub (Face ID toggle, active sessions, danger zone)
│ └── SET-005 Change 6-digit keycode (2-step)
├── Notifications
│ ├── SET-006 Preferences (push, email — granular toggles)
│ └── SET-007 Inbox (deep-linkable from push)
├── Subscription
│ ├── SET-008 Current tier (Plus/Everyday/Premium)
│ └── SET-009 Upgrade confirm (prorated billing)
├── Support & Legal
│ ├── SET-010 PITStop (chat, FAQ, email)
│ └── SET-011 Legal docs (T&Cs, Privacy, Card Agreement, Licenses)
└── Close Account (destructive)
├── SET-012a Warning (lists all consequences)
└── SET-012b Type-to-confirm + reason capture
Profile Hub SET-001
| ID | Screen | Key details |
|---|
| SET-001 | Profile Hub | Avatar (initial + brand orange), full name, tier badge (e.g. "TEMPO PLUS · Member since 2026"). Three sections: Account (Personal, Security, Notifications, Subscription), Support & Legal, Sign Out (red text, no-border). Tab bar persists. |
Personal Details SET-002 → SET-003
| ID | Screen | Key details |
|---|
| SET-002 | View Personal Details | Split into two groups. Identity (read-only): full name, DOB, nationality — locked 🔒. Changes require re-Veriff. Contact (editable): email, phone, address — blue "Edit" link per row. |
| SET-003 | Edit Email/Phone/Address | Current value shown disabled. New value input. For email: 6-digit code sent to new address. For phone: SMS code. For address: triggers Veriff re-check (proof of address). Biometric confirm before save. |
Security SET-004 → SET-005
| ID | Screen | Key details |
|---|
| SET-004 | Security Hub | Face ID toggle. "Change keycode" row (shows last-changed date). Active sessions list — current device at top marked "now", others have "→" to sign out individually. "Sign out of all other devices" red-border button. Danger zone: "Close account" red row. |
| SET-005 | Change Keycode | Step 1: enter new 6-digit code. Step 2: confirm by re-entering. Same keypad component as onboarding. Biometric required to reach this screen. |
Notifications SET-006 → SET-007
| ID | Screen | Key details |
|---|
| SET-006 | Notification Preferences | Push toggles: card payments (on), funds received (on), large transactions >£250 (on), rewards & perks (off default), product updates (off default). Email: monthly statements (on), security alerts (on — forced, regulatory). Saves on toggle, no explicit "Save". |
| SET-007 | Notification Inbox | Reverse-chronological. Unread = filled orange dot + highlighted row. Categories: payments, rewards, security, transfers, ecosystem. Tap row → routes to relevant screen (transaction detail, reward claim, session review). |
Subscription SET-008 → SET-009
| ID | Screen | Key details |
|---|
| SET-008 | Current Plan | Large branded card showing current tier (yellow for Plus). Plan inclusions listed. Other plans below with "Switch" (downgrade) or "Upgrade" links. Cancel subscription link at bottom (red text). |
| SET-009 | Upgrade/Switch Confirm | New plan card (black/orange for Premium). Prorated amount shown + next full billing date. Payment taken from Tempo balance. Confirmation text: "You can cancel anytime." |
Support & Legal SET-010 → SET-011
| ID | Screen | Key details |
|---|
| SET-010 | PITStop Support | Hero panel: dark gradient with "We're here · avg 2 min reply" + "Start chat →" CTA. Quick help categories: Card & payments, Transfers, Account & security, Rewards. Secondary: FAQ, Email support. |
| SET-011 | Legal Documents | Agreements with acceptance dates. Regulatory section: FCA firm ref, FSCS protection, Open-source licenses. Each item opens WebView. Material changes trigger in-app notification. |
Close Account SET-012
| ID | Screen | Key details |
|---|
| SET-012a | Close · Step 1 Warn | Full consequences list: subscription cancelled, cards disabled, balance transferred, rewards deleted, transaction records retained 7 years (regulatory). Yellow callout confirms balance refund timeline (3 business days). Red "Continue to close" button. |
| SET-012b | Close · Step 2 Confirm | Type-to-confirm: user must type "CLOSE" exactly. Reason-for-leaving picker (optional, 5 options). Final red "Close account permanently" button. No undo. |
Acceptance Criteria
- All Settings edits require biometric or keycode authentication before committing
- Identity fields (name, DOB, nationality) cannot be edited in-app — must open a support ticket
- Email/phone changes require code verification sent to the new contact method
- Address changes trigger a Veriff proof-of-address re-check before being applied
- Security alerts cannot be disabled (FCA requirement)
- Active sessions list refreshes on open; remote sign-out invalidates the target session within 5 seconds
- Close account is a two-step confirmation; user must type "CLOSE" exactly (case-sensitive)
- After close, balance is returned to the nominated bank account within 3 business days
- Subscription upgrades are prorated to the current billing cycle; downgrades take effect at the next cycle
Open Questions
- Can users change the account nominated for balance refund on closure, or is it fixed at onboarding?
- What's the SLA for PITStop chat outside business hours — bot fallback or just "we'll reply in the morning"?
- Do we support multiple nominated withdrawal/refund accounts, or is it strictly one?
- How long do we retain chat history in PITStop — GDPR window vs product utility?
- Do we offer a "pause account" option as a lighter alternative to full closure?
Integration Notes
- Equals Money — account closure, balance refund, subscription billing events.
- Veriff — re-verification for address changes (same integration as onboarding).
- Push provider (Firebase / APNs) — preference sync; "Security alerts" flagged server-side as non-overridable.
- PITStop chat — third-party provider TBD (Intercom / Zendesk / custom). SDK integration required.
- Tribe builds — all UI, preference storage, session management, closure workflow.
Cross-cutting New in v0.4
Non-functional Requirements
Requirements that span every feature group. Performance, security, accessibility, analytics, and offline behaviour. Where individual feature specs are silent, these apply by default.
Performance Targets
- App cold start to Wallet Home visible: <1.5s on iPhone 12 / mid-tier Android
- Wallet balance refresh from Equals API: <800ms p95
- Transaction list initial paint: <500ms (skeleton first, then data swap)
- Biometric prompt to authenticated screen: <400ms after success
- Send & Pay confirm to success screen: <3s (UK), <6s (international)
- Skeleton states used for any network-dependent surface that takes >300ms to load
Security
- All requests to Equals use short-lived tokens; refresh on app foreground if stale
- Card PAN/CVV shown only after biometric re-auth and auto-hidden after 6 seconds
- PIN never transmitted or stored in plaintext; reveal is ephemeral (client-only)
- Biometric data stored on-device only (Secure Enclave / Keystore); never leaves the device
- App locks after 60 seconds of background; biometric required on foreground
- Jailbreak/root detection on launch; app refuses to run on compromised devices
- Screenshot/screen-recording blocked on card details, PIN reveal, and Send review screens
Accessibility
- Target: WCAG 2.1 AA on every production screen
- Minimum tap target: 44×44pt (iOS) / 48×48dp (Android)
- All interactive elements have VoiceOver/TalkBack labels (not just visual icons)
- Supports iOS Dynamic Type up to "Accessibility XXL"; layouts reflow without truncation
- Colour contrast: text ≥4.5:1 against background; large text ≥3:1
- Reduced-motion: respects user preference — skeleton pulse and transitions simplified
- No information conveyed by colour alone (e.g. "declined" also has ✕ icon + red text label)
Analytics & Event Tracking
- Screen-view events fire on every navigation; ID matches wireframe (e.g.
wal_001_home)
- Funnel events for: onboarding completion, first transaction, card activation, first send
- Ecosystem carousel tracks: impression, tap-through, conversion (by slot + campaign ID)
- Error events include: reason code, screen ID, user state (tier, card status, session age)
- PII never included in event properties; user ID is pseudonymous
Offline & Edge Behaviour
- Wallet home shows last-known balance with a "Last updated X min ago" marker when offline
- Transaction list shows cached entries; pull-to-refresh retries silently
- Send & Pay blocked offline with clear messaging — never partial-submit
- Biometric works offline (Secure Enclave / Keystore is local)
- Push notifications queue and deliver on reconnect
Open Questions · Cross-cutting
- Dark mode: phase 1 or defer to v1.1? (All current wireframes are light-mode only)
- Localisation: UK English only for launch, or also EU locales from day one?
- Currency display: always GBP, or auto-switch based on user's market at onboarding?
- Analytics provider: Segment + Amplitude, or Firebase Analytics, or both?
- Minimum OS support: iOS 15+ / Android 11+ — or stretch to one version older for reach?