Design the data model for recording money movement in a marketplace. What properties are non-negotiable?
Show the full answer Hide the answer
What the interviewer is testing
Whether you reach an append-only double-entry model rather than mutable balance rows.
The non-negotiable properties
Immutability. Entries are never updated or deleted. A correction is a new reversing entry, not an edit. This is what makes the record auditable and what makes "why is this balance what it is" answerable.
Double entry. Every movement produces balanced entries — money leaves one account and arrives in another, and the sum of all entries is zero. This makes a whole class of errors structurally impossible and detectable: if the ledger does not balance, something is wrong, and you know immediately.
Balances are derived, not stored. A balance is the sum of entries for an account. Storing it as a mutable field creates a second source of truth that can drift from the entries. Materialise it as a cached projection for performance, with the entries authoritative and periodic verification that they agree.
Idempotency on every write, keyed to the originating business event, since retries are certain and a duplicate entry is money created or destroyed.
Bitemporality. Two timestamps: when the movement occurred, and when it was recorded. They differ — a transaction on Friday recorded on Monday — and financial reporting requires both. "What did we know on the 31st" and "what actually happened by the 31st" are different questions and both get asked.
The model
Accounts, entries and transactions. Every transaction contains two or more entries that sum to zero. Accounts exist per participant per currency — the customer, the merchant, the courier, the platform's fee account, and an account for money in transit at the payment provider.
What a strong answer adds
Money in transit needs its own account. Funds captured from the customer but not yet disbursed exist somewhere, and modelling that explicitly is what makes reconciliation against the payment provider's statement possible. Systems that omit it cannot explain the difference between their ledger and the bank.
And reconciliation as a standing control: a scheduled comparison against the provider's records, alerting on any discrepancy. The ledger is internally consistent by construction; agreement with external reality is a separate property that must be checked.
Common weak answers
A balance column updated in place. A transaction log without double entry, which cannot detect a one-sided error.