In-House vs Outsourced Software Development in Fintech: Who Should Build the Regulated Parts

Last updated: November 12, 2026

By Kris Drouet, Vice President, Engineering, in partnership with KORE1

The most uncomfortable question I have watched an auditor ask was four words long. Who approved this change?

The change was to a settlement job at a payments company, a few months old, shipped on a Friday. The engineer who wrote it worked for an outside development firm. So did the reviewer. The pull request, the review comments and the only record of the approval lived in the firm’s repository, and the firm’s engagement had ended in the spring. We got the records back. It took three weeks, two lawyers and a favor. (This is a composite of two engagements with the details changed, so nobody can be picked out of it.)

Nothing in that story is about the quality of the firm’s engineering, which was fine. It is about where the trail lived.

I write in partnership with KORE1, a staffing firm that places contract engineers into your repository. That is the model I end up recommending for the regulated parts, so weigh my view accordingly. KORE1 is not a development shop and does not pretend to be, and the box near the end says so in its own voice. The way it fits into an engineering organization is laid out in the operating model for contract engineering teams, and the lending and payments seats are covered under mortgage tech and fintech engineering staffing.

In-House vs Outsourced Software Development: What Is the Real Difference?

In-house software development means your own repository and your own engineering leaders, with the work built by employees plus contract engineers you direct and pay hourly. Outsourced development means a development firm builds to its own plan, often in its own repository, and hands over releases when they are done.

Anyone searching in house vs outsourcing software development wants the general answer first, so here it is. Notice what the definition leaves out. Nothing in it says cheaper, faster or offshore. It is about ownership and direction, all the way down.

Start with who you call when the plan changes. Say a partner bank asks for a new fee-waiver rule on a Tuesday. In-house, you message whoever owns the rule engine and it’s a ticket by lunch. Outsourced, you email the firm’s project manager, and the reply opens with “let me check the plan.” Neither is wrong. They are different relationships, and only one of them lets you change your mind for free.

Speed is the outsourcing pitch’s best slide. For a first release it’s often true, because the firm arrives with a team already in the room. I have watched the invoice for that speed come due around release three, when you want to turn left and the roadmap isn’t yours.

Cost gets argued the most and measured the least. Bain’s 2026 Technology Report found that “for every dollar spent on technology, four are spent on people and process”, a sentence I would tape to the wall before any vendor meeting. So the real choice is who owns the people and the process. The tooling hardly matters.

Then there’s knowledge, which nobody budgets for. Ask a firm that rolled off in March why your late-payment fee rounds down on the 28th, and listen to the silence. Whatever it learned about your rules left with it, unless somebody wrote it into your repository, your runbooks or your own engineers’ heads. Employees keep that knowledge. Contractors working in your repo leave most of it behind by default. A firm working in its own repo takes it home with the laptops. Nobody sees that line item.

Why Does Fintech Change the Answer?

Go back to that settlement job for a second. The auditor did not care whether the change was any good, and honestly it was. The question was whether we could show who wrote it, who reviewed it and who approved it, in that order, with records and not recollections. When the trail sits in a vendor’s repository, you depend on the vendor’s records, the vendor’s access controls and the vendor’s retention schedule, which is three things you don’t control standing behind evidence you will have to produce on somebody else’s deadline, usually with a lawyer copied on the email. Not a fun afternoon.

For banks and their fintech partners, the June 2023 interagency guidance on third-party relationships puts the principle bluntly. The Federal Reserve, the FDIC and the OCC wrote that a bank’s use of third parties “does not diminish its responsibility” to operate safely and comply with the law “to the same extent as if its activities were performed by the banking organization in-house.”

Read that as an engineer. Whatever the firm builds, the bank still answers for it. If you are a fintech with a sponsor bank, that responsibility reaches you through the bank’s contract with you. If you are a non-bank lender, your regulators are different, though in my experience the trail they ask for looks the same.

Same question. Different letterhead.

Which Fintech Code Can a Development Firm Own in Its Own Repository?

Less than the proposal will suggest, and more than a nervous compliance team would allow. Four kinds of work travel well.

• Your marketing site and its content tooling.
• Internal tools that never see production data, such as a vendor-onboarding checklist or a reporting dashboard fed from synthetic extracts.
• A mobile or web front end that only calls your APIs, where the firm builds the screens and has no way to change what the API does.
• Prototypes you intend to throw away.

Four conditions go with all of them. The firm never holds production credentials. It never sees customer data either, and I include masked extracts that someone determined could reverse. The API contracts are yours, versioned on your side. Last comes a written handover clause saying the repository, the build pipeline and the full commit history come to you on request and again at the end, in a format you can open without their help. Dull, and deliberate.

Which Code Stays in Your Repository, Built by Contract Engineers You Direct?

The ledger. Money movement. Credit decisioning and underwriting rules, KYC and AML decision logic, and anything else an examiner or auditor will trace to a person.

These stay in your repository because the trail has to be yours, and because the people who understand why a rule exists should be people you can still find in three years. Contract engineers, billed hourly, work inside your software development lifecycle, which means your branch protection applies to them, your reviewers approve their pull requests, and your access controls decide what they can touch and the day it ends. Same bar as an employee. Different badge color.

Devin Hornick, a partner at KORE1, described the model plainly when we talked about how contract work is billed: “Hourly, which we prefer. It’s really more of a staffing model to do the hourly billing and you manage the person.” The last four words carry the weight. You manage the person, so the work, the reviews and the evidence remain yours.

Whether a given seat should go to a contractor at all is a separate sort. I wrote that one up already, so sort the work by how long the knowledge has to live and come back here for the repository question.

My Repository-Ownership Table for Fintech Code

I wish somebody had handed me this table before the settlement-job conversation, so now I hand it to any CTO who has a proposal on the desk and an exam on the calendar. Read across a row. Where the second column says no, the fourth column is the evidence you will be asked for.

Ranges run from the 25th to the 75th percentile of the KORE1 Contract Rate Index 2026-Q4, effective October 16, 2026. They are bill rates, and they are national modeled cells, which I explain further down.

What Changes for Access, Reviews and Audit Evidence When a Firm Owns the Repository?

Everything that used to be a setting you control becomes a term you negotiate, and at the payments company those terms were where the three weeks went. Before anyone writes a line of code, I’d want answers on five things.

• Who holds admin on the repository? One team I know found out mid-audit that the only admin was the firm’s engagement lead, who had been moved to another account the month before. Getting access back took two days of escalations.
• Whose approval counts for a merge, who can bypass branch protection, and whether you can read the rule set yourself.
• Where commit history and CI logs are kept. Retention in writing, with a number of years, not in somebody’s head.
• What happens when one of the firm’s engineers leaves the firm. How fast does access die, and does anyone tell you?
• IP assignment and handover, with the assignment terms covered in contractor IP ownership agreements. People read the assignment half. The handover half is where I’ve watched things stall.

Here is a cheap test. Ask for a read-only export of the repository, history included, in the first week, and see whether the firm that is supposedly comfortable with its own handover clause says yes in an afternoon. One that hesitates has told you something. This whole section comes down to who holds the keys.

Funded Regulated Builds You Cannot Push Into 2027: What Breaks If the Firm’s Timeline Slips?

Devin Hornick put a question in an email to our team that I have not been able to stop thinking about. “What technology initiatives are already funded that you can’t push into 2027?”

Fintech has an unusual number of them, and the payments company in my story had one, a partner bank’s review date that was never going to move. Others I run into are a partner bank’s launch, an exam window, a regulator’s deadline for a rule change, or a card program a sponsor has already announced to its customers. None of those dates care about a development firm’s release plan because they belong to other people. A slipped vendor release does not move an exam date. You just walk in with the old system, and the examiner writes down what they see. Nobody enjoys that meeting.

When the work sits in your repository with engineers you direct, the answer to a slipping plan is adding capable hands to a plan you already own. KORE1 contract placements start a median of 3 days after the offer (n=1,997). I should be fair about what that clock covers. It starts at the offer, and finding the right person comes first, which averages 17 days across KORE1’s IT roles.

When the work sits in the firm’s repository, adding hands means asking the firm, and whoever you add works in a codebase you can’t see into. I’d rather have the lever in my own hand.

What Does the In-House Path Cost With Contract Engineers?

I will use index cells only and leave any firm’s proposal unpriced, since I haven’t seen yours. Four cells sit behind this post.

The national cells are modeled, which is the honest word for them. They start from the Bureau of Labor Statistics OEWS May 2025 wages, add a 24% employer burden and apply the bill-to-cost range KORE1 observes, so burden is already inside every bill rate above and nobody has to add it back later. The bottom row is different. It’s observed, drawn from seven senior placements, and seven is a small number, so I treat it as a data point and nothing grander. Small sample. Say so. The contract rate methodology page has the full method.

You are billed hourly and you manage the person, which is the part I keep coming back to. (I’m overstating slightly. You also manage the paperwork. But only slightly.) One seat is easy math, a whole team less so, and I’ve worked that through in what a contract development team costs per month.

One more number, because it changes the decision. Of KORE1’s contract-to-hire placements, 37.5% convert to permanent employment (207 of 552). For the contractor who ought to stay, conversion carries no fee after 1,040 hours, so the engineer who learned your ledger doesn’t walk out the door on the last day of the engagement.

Questions CTOs and COOs Ask Before They Sign Anything

Is outsourcing software development actually cheaper than building in-house?

Not by default, because the comparison usually leaves out the people and process cost. Bain’s 2026 Technology Report puts four dollars on people and process for every dollar on technology. For the in-house path, a senior contract engineer bills $118 to $142 an hour nationally, median $131. I have not priced any firm’s proposal, so compare your own.

Can an outside firm work on regulated fintech code?

On the edges, yes. On the core, not in its own repository. A firm can own a marketing site, a no-data internal tool or a front end that calls your APIs, while ledger, money movement and credit decisioning stay with engineers you direct. Firm engineers can still work in your repository under your reviews, though that is closer to staffing than outsourcing.

Who owns the code a development firm writes for you?

Whoever the signed agreement says, and until it says otherwise, usually the firm. Get a written assignment and a handover clause that gives you the repository and its history. The terms I look for are in the access section above, and this is general information, so have counsel read yours.

Is staff augmentation the same as outsourcing?

No. Staff augmentation adds engineers to your team and your repository, while outsourcing hands the work to a firm’s team. I compare the two models in staff augmentation vs outsourcing.

Draw the Line Before the Proposal Arrives

The ones that went wrong went wrong the same way. Somebody signed first and asked where the repository lived second. The payments company from my opening story now keeps its settlement code in its own repository, with contract engineers on hourly seats and an admin list short enough to read aloud, and the next auditor’s question took about four minutes to answer. The teams that did well drew the line early. Marketing site, internal tools and front ends outside. Ledger, money movement and decisioning inside, with the table above stapled to the requisition.

If you want contract engineers who already work inside a regulated codebase, talk to the KORE1 team and bring the table. Or start with the hourly bill rates by role and see what the seats cost before you read a single proposal.

As of November 2026. Rates are from the KORE1 Contract Rate Index 2026-Q4, effective October 16, 2026, and the engagement figures reflect KORE1 W2 contract placements, 79% of them in California. This post is reviewed every six months. It is general information and not legal advice.