Financial and fintech strategies

Documentation Index

Fetch the complete documentation index at: https://documentation.onesignal.com/llms.txt

Use this file to discover all available pages before exploring further.

A financial and fintech messaging strategy targets apps where success depends on completed verification, secure account behavior, and sustained transaction activity. If your product handles deposits, trades, payments, or any user-attached financial data, this guide is for you. This page is the implementation hub: which user identifier to set, what compliance and behavioral data to capture, which segments to build, and which Journeys drive verification, security, conversion, and retention. Each section links to the canonical docs for deeper detail.

​

Implementation roadmap

Work through these steps in order. Each one links to its section below.

​

Identify your users with External IDs

External IDs preserve identity across installs and tie push, email, and SMS to one customer profile. Use the unique identifier from your authentication, KYC, or core banking platform — for example, a Cognito or Auth0 uid, or your internal customer_id. Set the External ID at signup, on every login, and on session resume. The OneSignal SDK does not assign it for you, and assigning it late or sporadically breaks attribution between messaging, KYC outcomes, and downstream transactions — making compliance audits and funnel analytics unreliable.

​

Recommended data

Tags persist on the user profile (current state); Custom Events record discrete moments (what just happened). Use both — Tags drive compliance-aware segmentation and personalization, Custom Events trigger Journey entry and Wait Until conditions. Fintech leans heavily on Tags for state (account_status, kyc_completed, 2fa_enabled) because so much messaging is gated on whether the user is in a particular regulatory or onboarding stage. Custom Events handle the moments — verification submission, transactions, security changes — that move users between those states.

​

Tags

Tags persist on the user profile and are used for segmentation and personalization. For boolean-style signals, set the Tag to 1 when true and remove it when false — segment with “tag exists” rather than storing 0/false values.

​

Account and compliance state

​

Security and trust

​

Engagement and value

​

Product holdings

Track which products and features a user has adopted. These Tags do double duty: as filters for cross-sell audiences (“checking but no card”), and as exclusions so you never pitch a product the user already owns.

​

Personalization

​

Custom Events

Send a Custom Event for each moment you want to react to. Events are stored shorter-term than Tags but can carry properties (transaction amount, currency, transaction type), making them ideal for Journey entry triggers, Wait Until conditions, and Liquid personalization. Use lowercase snake_case for event names and keep them consistent across your app and backend.

​

Segments

Combine Tags and Custom Events into segments. Start with these eleven:

​

Journey examples

With Tags, Custom Events, and segments in place, build Journeys against them. Fintech Journeys mix channels by intent — push and in-app for in-the-moment nudges, email for receipts, statements, and longer-form content, and SMS for high-trust moments like verification, 2FA codes, and large-transaction confirmations. The lifecycle has six core flows:

​

Common fintech patterns

• Multi-channel verification. Don’t rely on email alone for KYC reminders — bounce rates and inbox placement vary, and verification has a hard time window. A push + email + SMS cadence across the first 48 hours measurably lifts completion. Trigger from signup_completed and exit on verification_completed.
• 2FA setup uplift. Identify users with 2fa_enabled absent and run a 7-day Journey of in-app messages and emails framing 2FA as account protection, not friction. Pair with a hard gate on high-risk actions (transfers above a threshold) to make the upside concrete.
• First-action promotion. A common new-user cadence is Day 1, Day 2, Day 4, Day 6 following verification, each surfacing a specific first action — deposit, trade, payment — with a small incentive (“$10 toward your first trade”) to clear the activation hurdle. Exit on first_transaction_completed.
• Feature adoption and cross-sell. Use Product holdings Tags as exclusion segments — never pitch a product the user already owns. Trigger cross-sell Journeys from a lifecycle moment (90 days after signup_date, or post-first_transaction_completed) and use application_started as a Wait Until anchor with a 7-day expiration to branch on whether the user finishes the application. Exit on feature_enrolled, and have your backend set the matching has_* Tag so the user is permanently excluded from that pitch.
• Promotional offers. Pair a promotion_redeemed event with a promo_code property to measure each campaign’s funnel and to attribute downstream activity. Exclude users who already redeemed a promo from re-targeted versions of the same offer to avoid awkward repeat pitches.
• Transactional alerts. Status, money received, balance changes, payments, and identity-verification confirmations should all flow as transactional messages. Send these via the Transactional messages API so they bypass marketing-consent gates and meet delivery-time expectations.
• Security event confirmations. device_added, password_changed, and large_transaction events should trigger immediate confirmation messages. Many regulators require these; users expect them as a sign of a trustworthy product.
• Risk-tier-aware cadence. Use the risk_tier Tag to scale security and disclosure messaging. The High-Risk Users segment gets tighter cadences on device_added and password_changed confirmations, lower large_transaction thresholds, and faster expirations on Wait Until branches that gate sensitive actions.
• Jurisdiction-aware copy. Use the jurisdiction Tag to vary disclosure language, frequency caps, and channel choice — for example, holding back marketing SMS in TCPA-heavy regions or swapping in EU-specific privacy copy for eu users. See Liquid syntax for how to branch message content on Tag values.
• Marketing-consent gating. Filter every marketing Journey on marketing_consent_email = "1" (or marketing_consent_sms = "1"). Transactional Journeys via the Transactional messages API are exempt — they aren’t marketing messages and shouldn’t be gated by consent.

Measure success by KYC completion rate (within 48 hours), 2FA enablement rate, time-to-first-transaction, and Active Traders retention — not just opens or CTR.

​

FAQ

​

How is this different from the Mobile-first strategy?

Mobile-first targets subscription, freemium, and trial-driven apps where success is measured by trial-to-paid conversion. Fintech overlaps on the data foundation (External IDs, Tags, Custom Events, segments) but adds compliance state (kyc_completed, account_status), security state (2fa_enabled), and transactional moments as first-class concepts. The lifecycle is shaped around verification, security, and recurring transactions — not trial conversion.

​

Should I send marketing and transactional messages from the same Journey?

No. Keep transactional flows (receipts, security alerts, verification confirmations) separate from marketing flows (promotions, upsells, re-engagement). Mixing them creates compliance risk — marketing-consent revocations should not silence transactional notices, and transactional messages should not be subject to marketing-frequency caps. Use the Transactional messages API for the former and standard Journeys for the latter.

​

How do I handle messaging for suspended or restricted accounts?

Build a Suspended segment on account_status = "suspended" and use it as an exclusion segment on every marketing Journey. Transactional and account-recovery messages can still send — those are typically required regardless of marketing status — but promotional and engagement nudges should never reach users in a restricted state.

​

When should I use SMS over push?

SMS is appropriate for high-trust, time-sensitive moments where push delivery is unreliable or the user isn’t logged in: verification codes, 2FA codes, suspicious-activity alerts, and large-transaction confirmations. It’s also the right channel when the user might be locked out of the app. Avoid SMS for marketing — the cost-per-message is high, opt-out rates are punishing, and many jurisdictions have strict marketing-SMS regulations.

​

Do I need data integrations to use these Journeys?

No. You can build basic verification reminders and re-engagement using dashboard-only segments like “First Session” and “Last Session.” Custom Events and Tags give you precise compliance-aware triggers and exit conditions, but they are not required to ship the first version.

​

What about apps that mix banking with other products (e.g., insurance, lending)?

The data foundation extends naturally. Use the Product holdings Tags as filters and exclusion segments on top of the base lifecycle audiences — and add product-specific Tags (has_insurance, has_mortgage) and Custom Events as you launch new lines. Each product line typically gets its own Journey set with the shared compliance and security flows running underneath.

​

Related pages