# Engineering referral loops for regulated money apps
Open Cash App and there is a good chance you first arrived because a friend sent you a link promising a small cash bonus, often cited around $5, if you signed up and sent a payment. That is not a random giveaway. It is a carefully tuned growth machine that has helped Cash App reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → tens of millions of users, and it operates inside strict financial rules that most consumer apps never touch.
This lesson breaks down how these loops actually work, how to model whether they grow or fizzle, and how to design the payout so your legal team does not kill it.
In most consumer apps, a referral gets you a new user. In fintech, a referral can get you a *funded account*: a customer who has connected a bank, loaded money, or completed a transaction. That is worth far more.
The catch: you are moving real money and touching regulated activity. Every dollar of incentive, every claim in your invite copy, and every eligibility rule is subject to consumer protection law.
Two terms to define up front:
Cash App's classic referral gives both the referrer and the new user a cash bonus, but only after the new user sends a qualifying payment (commonly using a linked debit card) within a set window.
Notice the design choices:
The genius is that the trigger action (sending a payment) is also the habit Cash App most wants to build. The incentive and the activation metric are the same thing.
Chime, a banking app whose accounts are provided through partner banks, has historically paid a referral bonus only after the new user receives a qualifying direct deposit (a paycheck routed to the account) above a threshold.
That is a much heavier trigger than sending $5. But it selects for the exact customer Chime monetizes: someone using the account as their primary bank. A referred user who sets up direct deposit is worth vastly more than a casual signup.
The lesson: choose the trigger that matches your unit economics, not the easiest one. Cash App optimizes for transaction volume, so it triggers on a payment. Chime optimizes for primary banking relationships, so it triggers on direct deposit.
Before you fund a single bonus, model whether the loop can actually compound.
The basic formula:
k = i × c
where:
i = invites sent per existing user
c = conversion rate of those invites (share who become qualified users)Example: if each user sends 4 invites and 10% convert to funded accounts, then kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → = 4 × 0.10 = 0.4.
A kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → of 0.4 does not mean failure. It means every 100 users organically generate 40 more, who generate 16 more, and so on. That is a meaningful amplifier on paid acquisitionpaid acquisitionVisitors arriving via paid ads or sponsored placements, where you pay a platform to display your message rather than earning visits organically.View full definition →, even though it is below the magic 1.0.
Two loops with the same kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → grow at wildly different speeds if their cycle time (how long one referral generation takes) differs.
Faster cycles compound faster. When you weigh Cash App's easy trigger against Chime's high-value trigger, cycle time is part of the tradeoff.
🎬 [VIDEO: "The Viral CoefficientViral CoefficientThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → Explained" — youtube.com — a short walkthrough of how kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → and cycle time drive compounding growth]
Your trigger is the single most important design lever. Set it too low and you pay for junk accounts. Set it too high and almost no one qualifies, so referrers stop sharing.
A practical framework, from lightest to heaviest:
1. Signup only. Cheap to trigger, worst quality. Avoid in fintech.
2. Account funded. User loads or transfers money. Better.
3. First qualifying transaction. Cash App's model. Proves real usage.
4. Recurring behavior (direct deposit, second transaction). Chime's model. Highest quality, slowest.
Rough logic: your referral payout (both sides combined) should sit comfortably below the expected lifetime valuelifetime valueLifetime Value: the total revenue (or profit) a customer generates throughout their entire relationship with your business.View full definition → of a user who hits that trigger.
If a direct-deposit user is worth an estimated multiple of a casual user, you can afford a larger bonus on that heavier trigger. That is why Chime's harder trigger can justify a real cash reward.
Build a simple table before launch: trigger type, expected conversion, expected value per qualified user, and max affordable payout. If the payout exceeds the value, the loop loses money on every referral, and scale makes it worse.
Here is where fintech marketers earn their salary. A referral offer is a promotional financial product, and it must survive both promotional rules and UDAAP scrutiny.
Under UDAAP, a "deceptive" act includes a claim that is likely to mislead a reasonable consumer. Applied to referrals:
The CFPB's UDAAP guidance is a free primer worth skimming with your marketing team.
Keep the rules simple enough that a non-expert can predict whether they will get paid.
Every referral program needs published terms covering:
Fraud is not just a cost problem. Paying bonuses on synthetic accounts can create anti-money-laundering and Know Your Customer (identity verification) exposure. Build fraud controls into the trigger itself: require identity verification and a genuine funded action before any payout.
Cash bonuses may carry tax-reporting implications for recipients depending on amount and structure. This is a coordination point with finance and legal, not something to improvise in a campaign. (Nothing here is legal or tax advice; confirm with qualified counsel.)
Knowledge check
1. Why is a referral in a fintech app generally more valuable than a referral in a typical consumer app?
2. A referral loop has a viral coefficient (k) of 1.3. What does this indicate about the loop's growth behavior?
3. Cash App gates its referral bonus on the new user sending a qualifying payment rather than on signup alone. What is the primary strategic reason for this design?
4. Select ALL correct answers about why UDAAP is a critical constraint when designing fintech referral loops.
Select all the correct answers.
5. Select ALL correct answers about design choices in Cash App's two-sided, action-gated referral mechanic.
Select all the correct answers.
When you design a referral loop for a money app, work in this order:
1. Pick the trigger that matches your core unit economics (payment volume vs. primary banking).
2. Estimate k and cycle time. Model conversion honestly; assume most invites do not convert.
3. Size the payout below the lifetime valuelifetime valueLifetime Value: the total revenue (or profit) a customer generates throughout their entire relationship with your business.View full definition → of a user who hits the trigger.
4. Write the offer in plain language and pressure-test it against UDAAP: is it clear, achievable, and free of hidden traps?
5. Bake fraud and identity checks into the trigger so you never pay on a fake account.
6. Publish clean terms and align finance and legal before launch.
The best fintech referral loops are boring to explain and hard to abuse. That is the point. Clarity is both a growth tactic (people share what they understand) and a compliance shield.