Loan-account data inside MoneyElephant, reached under borrower consent

SWIFTBIT COMPANY LIMITED lends between 2,000 and 50,000 baht through MoneyElephant, repaid over 120 to 180 days at up to 14.6% a year — the figures the app states on its own Play Store listing. Every one of those loans leaves a trail on the servicer’s backend: an application record tied to a Thai national ID, a funded balance, a day-by-day repayment schedule, and a credit tier that rises as the borrower pays on time. That server-side ledger is the thing an integrator wants. Reaching it is routine work for us.

The app markets itself on an automatic-approval engine and money in the account minutes after a decision. Behind that speed sits structured per-user state that keeps changing — new installments fall due, tiers move, limits grow. A one-off scrape is close to useless here; what pays off is a maintained feed that mirrors the ledger. Below is what MoneyElephant holds, the authorized way to it, and what we hand over.

The data MoneyElephant keeps on each borrower

These rows follow the flow the app itself walks a user through — register, get scored, draw a loan, then repay in installments. Each maps to a distinct backend surface.

Reaching the loan and repayment records

Two routes are live today for MoneyElephant, and a third is coming on a known regulatory clock. We describe each by what it reaches, the effort, how long it holds, and the piece we stand up.

Authorized interface integration

We analyse the traffic between the app and SWIFTBIT’s backend and rebuild the calls a client needs — login, token refresh, the loans list, the per-loan schedule, the tier field. This reaches everything the app’s own screens display. Effort is medium; durability tracks the app’s release cadence, so a maintained build carries a re-validation step. Access runs against a consenting account or an operator-provided test account, which we arrange with you while the work is scoped rather than treating it as something to clear first.

User-consented retrieval

A borrower authorizes access to their own records under PDPA. This is the cleanest legal footing for a single user’s loan, schedule and profile, and it maps directly onto MoneyElephant’s one-account-per-borrower model. Durability is tied to the consent window, and the design honours a withdrawal by stopping further pulls.

Regulated open-banking (BOT “Your Data”) — a forward path

Thailand’s central bank enacted the Your Data regulation in November 2025. It starts with personal deposit data in late 2026 and expands to loans and payment data across 2027–2028. It does not yet reach a lender like SWIFTBIT, but when its loan category goes live it becomes the most durable feed available, and we fold it in without re-architecting the client.

For now the working recommendation is plain: run the consented interface integration against a live borrower account, because Your Data will not touch loan records until its 2027–2028 phase and there is nothing to wait for in the meantime. When SWIFTBIT’s category is switched on, the same data model accepts the regulated source with the retrieval layer swapped underneath.

What integrators build with it

• A lender-side reconciliation job that pulls every active loan nightly and checks the computed payoff against SWIFTBIT’s stated balance, so a servicing discrepancy surfaces the next morning.
• A collections dashboard driven by the installment schedule — arrears buckets, days-past-due, and next-due amounts read straight from the same rows the borrower sees.
• A credit-risk feed that tracks tier and limit changes over time, feeding an underwriting model that needs the repayment history rather than a single snapshot.
• An affiliate or aggregator view that normalises MoneyElephant alongside other Thai cash-loan apps into one schema for comparison and routing.

What lands at the end of the build

The output is a working integration for MoneyElephant’s surfaces, not a report about them.

• OpenAPI description covering the login/token flow, the loans list, the per-loan schedule, the credit-tier field and the decision record — each response shaped to the fields above.
• Runnable source in Python or Node.js for those endpoints, including the token-refresh chain and retry handling, ready to run against a consenting account.
• Protocol and auth-flow write-up — how the session is established, how the bearer token is carried and refreshed, and where the schedule and tier data sit.
• Automated tests that assert the loan and installment shapes and reconcile computed interest against the app’s own worked example.
• Interface documentation plus data-retention and PDPA-minimization guidance covering how the national ID and other identity fields are stored.

A look at the loan-and-schedule call

Illustrative shapes, confirmed during the build against a consenting account — not lifted from any MoneyElephant or SWIFTBIT document. Field names stand in for what the mapping resolves.

# Session: Thai mobile number + OTP -> bearer token
session = login(msisdn="+66xxxxxxxxx", otp=code)      # returns { token, expires_in }

loans = GET("/v1/borrower/loans", auth=session.token)
for loan in loans["active"]:
    loan["principal"]     # e.g. 50000   (THB, within the 2000-50000 range)
    loan["term_days"]     # 120 .. 180
    loan["apr"]           # <= 14.60

    sched = GET(f"/v1/loans/{loan['id']}/schedule", auth=session.token)
    for inst in sched["installments"]:
        inst["due_date"], inst["amount_due"]
        inst["principal_part"], inst["interest_part"], inst["status"]

# Reconcile against the app's own worked example before shipping:
#   50000 * 120 * 0.146 / 365  ==  2400        # total interest
#   payoff  ==  50000 + 2400   ==  52400
# 401 -> refresh token; sustained 401 -> consent lapsed, halt and log
        

The reconciliation line matters. If our computed interest does not match SWIFTBIT’s displayed 2,400-baht example on a 50,000-baht, 120-day loan, the day-count assumption is wrong and the test fails before anything ships.

Consent and the Thai rulebook

Two frameworks govern this work, and they sit at different points on the clock. Thailand’s Personal Data Protection Act has been in full force since June 2022, overseen by the PDPC; it requires consent that is explicit, granular, logged and withdrawable, and its 2024 sub-regulations tightened cross-border transfer rules — which is why anything holding a national ID stays in-region unless the client has an adequacy basis. That consent is the dependable footing the integration rides on today.

The forward piece is the BOT “Your Data” scheme, enacted November 2025, which will let a borrower direct a provider to share their deposit, loan and payment data through a standard channel — loans landing in the 2027–2028 phase. We treat it as where the route is heading, not as present law. Separately, SWIFTBIT’s lending sits under Thailand’s consumer-finance regime, where the Bank of Thailand caps personal-loan interest at 25% and nano-finance at 33%; MoneyElephant’s stated 14.6% sits well inside that, which is worth confirming when reconciling servicing figures. Access is authorized, logged and data-minimized throughout, with an NDA where the client wants one.

Details the build gets right

A few things about this specific app shape the work, and we account for them rather than pass them along.

Day-count and the worked example

The listing advertises 14.6% a year, quoted as roughly 0.04% a day, and gives a worked example that divides by 365. We encode that exact day-count so our computed outstanding matches the app’s servicing figure to the baht, and the test suite checks it against the 52,400 total the listing prints.

Release drift on a fast-shipping app

Thai cash-loan apps update often, and a changed screen or renamed endpoint can quietly break a running sync. We keep a re-validation step in maintenance that flags an endpoint or field change on the next release, so it is caught before a nightly job returns empty.

Tier and limit as a time series

The credit tier is not static — it climbs with on-time payment and lifts the limit. We model it as a history rather than a single current value, so an underwriting consumer sees the progression, not just today’s number.

National ID minimization

KYC here centres on the Thai national ID. We pull it only when the client’s use case needs it, tokenize it at rest, and keep it out of any job — reconciliation, collections analytics — that has no reason to hold it.

Pricing and how you take delivery

From $300 you get the source-code package: the runnable endpoints for MoneyElephant’s login, loans and schedule surfaces, the OpenAPI description, the protocol and auth-flow notes, the tests, and the interface documentation — invoiced only after delivery, once you have checked it runs. If you would rather not host anything, the same coverage is available as an API you call and pay for per call, with nothing upfront. Either path builds in one to two weeks. Tell us the app and what you need from its data on the contact page, and we handle the access and authorization details with you from there.

Screens from the app

Store screenshots, used to trace the borrower flow that produces the data above.

Other Thai lending apps in the same integration picture

Named for ecosystem context — a unified feed usually spans several of these, since they hold comparable borrower and repayment data.

• LN เงินกู้ — online cash loans quoting a 0.04%-per-day rate; holds loan accounts and repayment schedules much like MoneyElephant.
• PROMISE สินเชื่อส่วนบุคคล — a licensed personal-loan app with per-borrower balances and installment records.
• Siam Digital Lending (SiamDL) — nano-finance and personal loans under BOT supervision, with account and repayment state.
• มีตัง (Me Tang) — unsecured loans of 3,000–50,000 baht over 91–180 days; a near-identical data shape to reconcile against.
• Kredivo Thailand — buy-now-pay-later and cash loans, holding limits, transactions and repayment plans.
• Rabbit Cash — installment and revolving loans under a BOT licence, with tenures and outstanding balances.
• Line BK — Kasikornbank–LINE lending inside a chat app, holding loan and account data.
• FINNIX (MONIX) — microloan app with per-user credit lines and repayment histories.
• MoneyThunder (SCB Abacus) — AI-scored personal loans holding decision and servicing records.
• KTC — Krungthai Card personal loans and credit lines with installment plans.

How this mapping was put together

On 1 July 2026 we read MoneyElephant’s Play Store listing for the loan terms, eligibility and servicer, then checked the Thai regulatory frame against primary sources: the Bank of Thailand’s Open Data (“Your Data”) programme and its public consultation, and a data-protection reference for Thailand’s PDPA. Loan and interest figures are taken from the app’s own listing and are not independently audited here; the SWIFTBIT company details are as the listing states them.

• Bank of Thailand — Open Data / “Your Data”: bot.or.th open-data
• BOT public consultation, “Your Data” framework (PDF): public-hearing paper
• Thailand PDPA overview: DLA Piper — data protection, Thailand
• App listing: MoneyElephant on Google Play

OpenBanking Studio integration desk — MoneyElephant mapping reviewed 2026-07-01.

Questions integrators ask about MoneyElephant

Can you retrieve a borrower’s live repayment schedule from MoneyElephant, or only the current balance?

Both. The servicing screens expose the full installment plan — due dates, amount due, and the split between principal and interest — not just an outstanding figure. We map each installment as its own row so a collections or cashflow system reads the same schedule the borrower sees, and we recompute the running balance against the app’s stated 14.6% figure to confirm the numbers line up.

Does Thailand’s Your Data open-banking scheme already cover MoneyElephant’s loan data?

Not yet. The Bank of Thailand enacted the Your Data regulation in November 2025, but Phase 1 starts with personal deposit data in late 2026, with loans and payment data phasing in across 2027 and 2028. Until a SWIFTBIT-category feed goes live, the dependable basis is the borrower’s own PDPA consent, and we reach the loan records through authorized interface integration.

How do you handle the Thai national ID and the rest of the personal data under PDPA?

We pull only the fields the client actually needs, so a portfolio-reconciliation job never touches identity documents it has no use for. Where the national ID is in scope it is tokenized or hashed at rest, access is logged, and consent records are retained. Thailand’s PDPA has required explicit, granular, withdrawable consent since it took full force in June 2022, and the build is designed so a withdrawal stops further retrieval.

We already have a consenting MoneyElephant account — how soon can a loan-and-repayment feed be running?

Once a consenting account or an operator test account is available, a working loan-and-repayment feed takes one to two weeks. That window covers mapping the login and token flow, the loans and schedule endpoints, the credit-tier field, automated tests, and the interface documentation. Access and any authorization paperwork are sorted out with you as part of that same work.