OTP Bank

OTP Bank, one of Central and Eastern Europe’s largest financial institutions, is modernizing its digital services through high-performance Flutter applications.

To meet strict banking compliance standards while maintaining developer productivity, OTP Bank’s mobile engineering chapter adopted DCM as part of its software quality and governance strategy.

Today, DCM is an approved internal tool within OTP Bank’s secure environment, supporting 20 developers daily across multiple squads, ensuring that all Flutter projects adhere to consistent, measurable, and auditable code standards.

Challenge

Financial institutions like OTP Bank must balance innovation with compliance. The mobile engineering team needed to:

• Measure and report maintainability metrics required by internal auditors and regulators.
• Apply consistent linting and security rules across internal Flutter projects.
• Integrate seamlessly with self-hosted systems without relying on cloud-based tools due to strict data security policies.

However, traditional SAST platforms lacked native support for Flutter/Dart. This gap made it difficult for the team to produce the necessary metrics and enforce the same quality standards that were already in place for other programming languages used within the bank.

Solution

After extensive research, the team discovered DCM, which provided a complete static analysis and metrics suite for Dart and Flutter.

"We picked DCM about a year ago when we realized SonarQube couldn’t fully support our Flutter stack. We wanted to prove to the bank that we could still measure quality and compliance and DCM was the perfect fit."

— David Födi, Mobile Engineer, OTP Bank

The team integrated DCM into their CI/CD pipelines and developer environments, enabling both continuous and local analysis.

They used metrics such as cyclomatic complexity, maintainability index, depth of inheritance, and technical debt, and applied comprehensive linting rules with over 200 configured, evolving over time. For example, pubspec.yaml rule checks implemented to prevent dependency mismatches or unapproved upgrades.

The engineering team set up custom rule boards, which consist of several engineers, for cross-squad governance, ensuring consistent standards while gradually increasing strictness.

Implementation Approach

To manage the initial 5,000+ violations found during onboarding, the team followed a progressive migration strategy in the following steps:

1. Introduced DCM in audit-only mode to collect violations.
2. Reviewed and categorized issues on an internal “rule board.”
3. Fixed violations incrementally — one rule at a time — assigning ownership to specific squads.
4. Used DCM’s baseline support to silence legacy issues temporarily while focusing on new code.

"We started with more than 5,000 lint warnings, and in just months, we brought that number down to around 200. Now we’re under 1,000 violations across projects and keep improving every sprint."

— David Födi, Mobile Engineer, OTP Bank

This gradual rollout allowed the bank to raise the bar for quality without blocking developer workflows or triggering compliance bottlenecks.

Impact

As a result, DCM is impacting 20 developers who actively use DCM daily, who have integrated it into their CI/CD pipelines to ensure consistent enforcement. Consequently, the team has reduced violations from 5,000+ to around 200 in initial projects, improved application performance, and reduced memory leaks through best-practice enforcement.

Moreover, DCM was approved by OTP Bank’s internal governance process because it is fully self-hosted.

"It’s already approved internally at the same level as SonarQube, that’s a huge milestone for us. DCM helps us ensure compliance and code quality across all Flutter projects."

— David Födi, Mobile Engineer, OTP Bank