Banca Movil BAC API integration (SINPE, ACH, Kash, Statements)

Deliverables checklist

• OpenAPI / Swagger specification for every contracted endpoint
• Protocol report covering BAC Code, fingerprint and device-binding chain
• Runnable Python and Node.js source for login, balance, statements, transfers
• Postman collection plus pytest / vitest harness with fixture data
• Compliance notes for SUGEF, Banco Central de Costa Rica and CNBS Honduras
• Deployment templates: Docker, Helm chart and a webhook gateway sample

Engagement & pricing

• Source code delivery from $300 — runnable APIs and full documentation; pay after delivery on satisfaction.
• Pay-per-call API billing — call our hosted endpoints and pay only for the calls you make, no upfront cost.
• NDAs available; partial scopes (statements only, transfers only) accepted.
• Long-term retainers cover protocol drift after BAC app releases (e.g. v5.43, v5.44).

1. Multi-country accounting sync

A regional retailer with stores in Costa Rica, Honduras and Guatemala wants daily ledger entries from every BAC operating account. We poll the statement API per country, normalise SINPE, ACH and Sinpe Movil legs into a single chart of accounts, and push entries to NetSuite or SAP. The OpenFinance angle is straightforward: standardise dispersed bank channels behind one canonical transaction object.

2. Sinpe Movil & Kash reconciliation for marketplaces

Costa Rican marketplaces accept Sinpe Movil; Salvadoran and Honduran sellers accept Kash. We ingest webhook callbacks plus polled movement deltas, match incoming amounts against open orders, and call the receipt endpoint to attach the same proof the app shares under Bank Accounts > Resend proof. Disputes drop because every payment is tied to a verifiable transaction reference.

3. Credit-card spend analytics & BNPL underwriting

Fintechs underwriting BAC credit-card holders need cycle-level data: payment dates, minimum and cash payment amounts, financing details, and recent transactions. The card-statement API exposes those fields plus loyalty-point balances, which feed both risk models and cashback comparison engines aligned with open-banking data-sharing patterns.

4. Treasury sweeps with cardless ATM controls

Logistics companies sweep cash from drivers using cardless withdrawal codes. We issue codes via the API, list pending withdrawals, cancel any that are no longer needed and reconcile completed pulls with GPS-stamped trips. The same flow works at Rapibac points, removing the need for physical cards on the road.

5. Goal-based wealth dashboards

Wealth-tech platforms aggregate Planned Savings (BAC Goals), pension funds and investment products into one view per household. Extraordinary savings events trigger notifications, and the My Finances categorisation is reused so that the dashboard agrees with what the user already sees inside Banca Movil BAC.

Authentication: BAC Code + device binding

POST /api/v1/bacmovil/login
Content-Type: application/json

{
  "country": "CR",
  "username": "user@example.com",
  "bac_code": "******",
  "device": {
    "id": "dvc_2f9c...",
    "fingerprint_hash": "sha256:...",
    "platform": "android",
    "app_version": "5.44.0"
  }
}

200 OK
{
  "session_id": "sid_8a1...",
  "access_token": "<jwt>",
  "refresh_token": "<opaque>",
  "expires_in": 1800,
  "managed_devices": ["dvc_2f9c...", "dvc_77ee..."]
}

Statement query (paged)

POST /api/v1/bacmovil/statements
Authorization: Bearer <ACCESS_TOKEN>

{
  "country": "CR",
  "product_id": "acc_001",
  "product_type": "checking",
  "from_date": "2026-04-01",
  "to_date": "2026-04-30",
  "include_retained": true,
  "page": 1,
  "page_size": 100
}

Response: {
  "items": [
    { "id": "...", "rail": "SINPE_MOVIL", "amount": -25000.00,
      "currency": "CRC", "counterparty": "+506 8888 1234",
      "status": "settled", "ts": "2026-04-12T13:25:11-06:00" }
  ],
  "next_page": 2,
  "total": 184
}

Outbound transfer (SINPE / ACH / Kash)

POST /api/v1/bacmovil/transfers
Authorization: Bearer <ACCESS_TOKEN>

{
  "rail": "ACH",
  "from_product_id": "acc_001",
  "to": {
    "bank_code": "0151",
    "account_number": "CR05015100010012345678",
    "name": "Acme S.A."
  },
  "amount": 150000.00,
  "currency": "CRC",
  "concept": "Invoice 2026-0421",
  "favorite": true,
  "approval": { "method": "BAC_CODE", "code": "******" }
}

201 Created
{ "transfer_id": "tx_91a...", "status": "queued",
  "receipt_url": "https://.../receipt/tx_91a..." }

Cardless withdrawal & webhook

POST /api/v1/bacmovil/cardless
{
  "from_product_id": "acc_001",
  "amount": 50000.00,
  "currency": "CRC",
  "channels": ["ATM", "RAPIBAC"],
  "ttl_minutes": 60
}

// Webhook delivered when code is consumed or expires
POST https://yourapp.example/webhooks/bac
{
  "event": "cardless.consumed",
  "code_id": "cw_44b...",
  "atm_id": "RB_HEREDIA_07",
  "ts": "2026-04-29T16:11:02-06:00"
}

Regional regulators we align with

Every Banca Movil BAC integration is deployed under explicit user authorization. In Costa Rica we follow guidance from Banco Central de Costa Rica for SINPE Movil, and SUGEF rules for account-data handling. In the rest of the region we observe CNBS (Honduras), SSF (El Salvador), SIB (Guatemala), SIBOIN (Nicaragua) and SBP (Panama). Where data leaves the country we add Standard Contractual Clauses and operate inside the spirit of GDPR for any EU-based processors.

Privacy & data minimization

• Per-scope tokens — statement read does not unlock transfer write.
• Consent ledger with timestamp, IP, device fingerprint and revocation event.
• Configurable retention windows (30 / 90 / 365 days) per data class.
• Card numbers tokenised; only last-four and PAR are shipped downstream.
• Audit trail readable by your compliance team via a dedicated endpoint.

About OpenFinance Lab

We are a small studio focused on App interface integration and authorized API integration for fintech and OpenData scenarios. Our engineers come from Latin American banks, payment processors, protocol-analysis labs and cloud platforms, and we have shipped Central American banking integrations end to end.

• Coverage across BAC's six countries plus neighbouring Costa Rican and Panamanian banks.
• Custom Python, Node.js and Go SDKs with replayable test harnesses.
• Pipeline: protocol analysis → API design → build → validation → compliance review.
• Source code delivery from $300 — runnable APIs and documentation; pay after delivery on satisfaction.
• Pay-per-call API billing — no upfront fee; you pay only for the calls you make against our hosted gateway.

Contact

For quotes or to submit a target app and requirements, open our contact page:

Contact page

Average first reply: under one business day. NDAs available before we open the technical scope.

Engagement workflow

1. Scope confirmation — countries (CR, PA, GT, HN, SV, NI), data classes (balances, statements, transfers, Kash, cardless), and SLAs.
2. Protocol analysis & API design — 2 to 5 business days, depending on how many BAC operating accounts are in scope.
3. Build & internal validation — 3 to 8 business days, with golden-path and edge-case fixtures per country.
4. Documentation, samples, Postman collection and pytest / vitest harnesses — 1 to 2 business days.
5. Typical first delivery — 5 to 15 business days; multi-country rollouts may extend depending on local approvals.

FAQ

Which countries does the Banca Movil BAC integration cover?

Can you export historical statements and movements?

How do you handle compliance and SUGEF requirements?

Do you support cardless ATM withdrawal codes?