The challenge
Najm Wallet's founder, Khalid Al-Mansouri, had pitched VARA (the UAE's Virtual Assets Regulatory Authority) on a sandbox licence for a custodial crypto-fiat wallet. VARA agreed to review on the condition that he demonstrate a working product, not a deck.
He had five working days.
Three constraints shaped the engagement:
- VARA's threshold is real software. They've sat through enough decks to know better. The demo had to include a live, on-chain settlement that they could verify on a block explorer.
- Custody and KYC could not be ours. Anything else and the licence path stretched by months. Fireblocks held the keys; Sumsub did the identity check; we built everything else.
- A failed demo would have been worse than no demo. "We almost shipped it" doesn't get you a sandbox licence. The bar was Friday-morning-confidence, not Thursday-night-hope.
How we approached it
A two-engineer pod paired with our QA lead and a Hashorn PM. The PM ran the day-by-day cadence; the engineers paired tightly so nothing was solo. Sumsub and Fireblocks integration work happened on day one in parallel with the wallet shell so we never hit a single-threaded blocker.
We treated the five days like a normal Hashorn sprint, just compressed: a one-page brief on Monday morning, a working build by Wednesday lunch, a signed build by Thursday EOD, dress rehearsals on Friday morning. The risk register was the most important artifact of day one — three of the four risks listed there came up during the week, and each had a pre-decided mitigation.
What we shipped
Day 1 — Brief, decisions, kickoff. Locked scope, vendors, demo path. Killed three nice-to-haves that wouldn't be in the demo (multi-currency support, push notifications, in-app referrals). Risk register signed off by Khalid.
Day 2 — Foundation. Phone-OTP auth with Sumsub identity verification. Postgres audit-log primitives with hash-chained append-only writes. React Native shell deployed to TestFlight; the QA engineer had a build on their iPad by 4 PM.
Day 3 — Wallet + on-ramp. Fireblocks custodial wallet provisioning on first sign-in. Mock AED card on-ramp routed through a sandbox PSP that VARA had pre-approved for the demo. First user balance: 1,000 AED, visible in the app.
Day 4 — Transfer + receipt. AED-to-USDC quote pulled from a pinned market-data source (so the on-stage network call wouldn't add latency variability). On-chain submit to a counter-party wallet on testnet. Cryptographic receipt generated, signed, and surfaced in the app.
Day 5 — Hardening + dress rehearsals. Playwright covering 14 critical specs across the five demo paths. Three signed builds delivered at three checkpoints of the demo so the founder could fall back to a known-good build if the live one failed. Three full dress rehearsals with Khalid running it himself.
Day 6 — VARA review. Khalid demoed live. The on-chain transfer settled in 11 seconds. The regulator's team verified the transaction on the testnet block explorer in real time, then asked three questions about the audit log. We had the answers ready.
The outcome
- Five working days from kickoff to live demo. No overtime — the team worked normal hours, with the risk register doing the work overtime would normally have done.
- Live AED-to-USDC transfer on stage, settled in 11 seconds, verified by the regulator on a public testnet explorer.
- Sandbox licence path confirmed the same afternoon. Khalid raised his pre-seed two weeks later.
- Zero critical defects at demo time. One medium issue (a copy bug on the receipt screen) was the only thing we shipped that wasn't perfect, and it was a typo.
- The audit-log architecture became the spine of the product. Every state change still flows through it; the regulator's auditors used it in the licence review three months later.
What we'd repeat
The risk register on day one was the single most important artifact of the week. Three of its four entries became real situations during the sprint, and each had a pre-decided response. The team never had to think about how to react under pressure — they just executed.
The other lesson: fall-back builds matter more than a perfect build. We gave Khalid three signed builds at three different points of the demo path so if any single one failed live, he could swap to a checkpoint and keep going. He never had to use them, but he walked into the VARA room knowing he had them. That's what got him through it.