bKash DSO API integration services (distributor & OpenFinance)

Deliverables checklist

• OpenAPI / Swagger spec covering login, balance, statement and B2B endpoints
• Protocol & auth flow report (SMS verification, PIN, token chain, tap-and-hold confirm)
• Runnable Python and Node.js reference clients for the DSO workflow
• Automated regression tests against a fixture or sandbox account
• Compliance notes covering KYC, BFIU Circular 20 expectations and data retention
• Production-ready logging, retry and idempotency patterns

Why bKash DSO data is worth integrating

bKash reported its highest-ever annual profit of Tk 676.33 crore in 2025, more than double the Tk 315.77 crore figure recorded in 2024 — a signal of how much commerce now flows through the distributor channel. Connecting the DSO app's structured data to ERP, treasury and risk systems lets distributors close their books faster, surface float shortfalls before they bite, and feed reliable evidence into BFIU compliance reports.

Because the DSO is the bridge between bKash's central platform and the long tail of agents and merchants, every transaction visible in the app is a candidate signal for credit scoring, agent-performance analytics and territory management.

1. Treasury float management for distributors

Business context: A regional distributor running dozens of DSOs needs sub-hour visibility on e-money and cash float so that agents never run dry on payday weekends.

Data & APIs: Balance feed polled every five minutes plus statement webhooks for inbound replenishments and outbound B2B transfers.

OpenFinance mapping: Equivalent to the account information primitive in PSD2 / Open Banking — read-only balance and movement data, normalized to ISO 20022-style fields.

2. Automated reconciliation for accounting and ERP

Business context: An accounting team imports bKash DSO statements weekly into Tally or SAP and has to match each line against issued invoices.

Data & APIs: Statement export endpoint with date-range and trxID filters, plus a CSV/Excel renderer that mirrors the in-app statement layout.

OpenFinance mapping: Aligns with the transaction history export use case standardized in many open data initiatives — same shape, different rails.

3. Agent performance & territory analytics

Business context: A territory manager wants weekly heat-maps of which agents are receiving the most B2B replenishments, with anomaly alerts on dormant or fraud-prone accounts.

Data & APIs: Aggregated B2B agent transfer feed, joined to the DSO profile master, surfaced through a GraphQL gateway.

OpenFinance mapping: Combines OpenData analytics with risk-control telemetry — agent-level KPIs become first-class objects in your BI stack.

4. AML / BFIU reporting pipeline

Business context: A compliance officer must file STR/SAR reports under BFIU Circular 20 and the Bangladesh Bank MFS Regulations 2022, and needs immutable transaction evidence.

Data & APIs: Append-only statement feed, hash-chained, with confirmation events and notification log; export-to-PDF for regulator submissions.

OpenFinance mapping: A regulatory-reporting overlay on top of OpenData — the same primitives, with chain-of-custody guarantees.

5. Distributor mobile super-app embed

Business context: A distributor builds an internal mobile dashboard for its DSOs that surfaces bKash data alongside competitor MFS feeds (Nagad, Rocket).

Data & APIs: Login session brokering, balance and statement endpoints, push-notification webhooks, all multiplexed behind one token per DSO.

OpenFinance mapping: A multi-rail aggregation pattern — the same idea Open Banking delivered for European retail accounts, applied to Bangladesh's MFS distribution layer.

Login & session bootstrap (pseudocode)

POST /api/v1/bkash-dso/session
Content-Type: application/json

{
  "dso_account": "01XXXXXXXXX",
  "pin": "<encrypted>",
  "sms_otp": "123456",
  "device_fingerprint": "<sha256>"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "session_scope": ["balance.read", "statement.read", "b2b.write"]
}

Statement query (pseudocode)

POST /api/v1/bkash-dso/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "type":      ["B2B", "CASH_IN", "CASH_OUT"],
  "page":      1,
  "page_size": 100
}

200 OK
{
  "items": [
    {
      "trx_id": "B2B25040712345",
      "type": "B2B",
      "counterparty": "01YYYYYYYYY",
      "amount": 25000.00,
      "currency": "BDT",
      "fee": 0.00,
      "status": "SUCCESS",
      "timestamp": "2026-04-07T10:22:11+06:00"
    }
  ],
  "page": 1,
  "total_pages": 7
}

B2B confirmation webhook (pseudocode)

POST https://your-app.example.com/webhooks/bkash-dso/b2b
X-Signature: sha256=...
Content-Type: application/json

{
  "event": "b2b.confirmed",
  "trx_id": "B2B25050812989",
  "dso_account": "01XXXXXXXXX",
  "agent_account": "01ZZZZZZZZZ",
  "amount": 50000.00,
  "currency": "BDT",
  "confirmed_at": "2026-05-08T14:05:33+06:00",
  "tap_hold_ms": 2400
}

Recommended handler:
- Verify HMAC signature with shared secret
- Idempotency key = trx_id
- On replay, return 200 OK without side effects

Regulations we align to

bKash operates under Bangladesh Bank as a subsidiary of BRAC Bank PLC. Every integration we deliver is mapped to the Bangladesh Bank Regulatory Guidelines for Mobile Financial Services 2022, the Guideline on ICT Security v4.0 (April 2023), and BFIU Circular 20 on AML/CFT, KYC, STR/SAR reporting and agent-monitoring expectations.

Where a deployment crosses borders — for example a regional distributor headquartered in Dubai or Singapore consuming the data via a centralized ERP — we add a privacy layer modelled on GDPR-style minimization, since Bangladesh's draft data-protection law is following that template.

Privacy controls baked in

• PIN never stored at rest; only an encrypted derivation used for session refresh
• Field-level masking for account numbers in logs and exports
• Configurable retention windows aligned to BFIU expectations
• Consent records linked to the SMS-verified onboarding event
• Optional on-prem deployment for distributors with sensitive territories

About us

OpenFinance Lab is an independent technical studio focused on App interface integration and authorized API integration for fintech, banking and adjacent sectors. Our engineers come from MFS operators, payment gateways, protocol-analysis teams and cloud-native back-ends, and we have shipped production integrations across South Asia, the Middle East and Southeast Asia.

• Mobile financial services, digital banking and cross-border clearing
• Authorized protocol analysis and API gateway design
• Custom Python / Node.js / Go SDKs and end-to-end test harnesses
• Full pipeline: protocol analysis → build → validation → compliance review
• Source code delivery from $300 — runnable API source, OpenAPI docs, pay after delivery on satisfaction
• Pay-per-call API billing — call our hosted endpoints with no upfront fee

Contact

Send us the target app (bKash DSO), the data flows you care about (statements, balances, B2B confirmations) and any sandbox or distributor credentials you already hold. We respond with a scoped quote within one business day.

Contact page

Engagement workflow

1. Scope confirmation: which DSO data flows you need (login, balance, statement, B2B), and the volume profile.
2. Protocol analysis & API design (2–5 business days, complexity-dependent).
3. Build, internal validation against fixtures or your sandbox account (3–8 business days).
4. Documentation, sample code and BFIU-aware test cases (1–2 business days).
5. Typical first delivery: 5–15 business days; cross-distributor or webhook fan-out can extend that.

FAQ

What do you need from me to start a bKash DSO integration?

How long does delivery take for a bKash DSO API drop?

How do you handle Bangladesh Bank compliance and data privacy?

Can you support both source-code delivery and a pay-per-call API?