Payment Checkout & Ledger Service  ·  View 16 of 24  ·  Runtime

Settlement and Payout Pipeline

Six stages from a file landing on an SFTP endpoint to money leaving the bank, gated on a trial balance.

Editable source SVG draw.io All views
Arrive Provider file drop 30 files / day Late-file alarm per provider SLA Ingest Idempotent ingest re-runnable Staged lines ≤ 10 M / file Restatement handling correct, never edit Match Match on ref + amount Matched · unmatched · disputed Break Break account posting nothing discarded Ageing > 48 h incident Dual-control correction Prove Trial balance 02:00 daily Cash position vs bank tolerance alarm Pay out Available balance minus hold period Sanctions screen hold, not reject Payout instruction unique key Return handling restore balance unmatched corrected proven credit back Settlement and Payout Pipeline External / third party Security / platform Application we own Data store Decision point Risk / gap failure / alternate synchronous Payout runs on proven cash, not on believed cash: the trial balance and the bank comparison gate the 06:00 run. v 1.0 · owner Payments Platform Architecture · date 2026-10

Decisions

  • Ingest is idempotent and re-runnable, and a restated file posts corrections rather than editing prior rows (ADR-07).
  • Unmatched amounts go to a named break account. Nothing is discarded, and a break aging past 48 hours is an incident, not a backlog item.
  • Payouts are gated on the trial balance and the bank cash comparison: proven cash, not believed cash.
  • A sanctions match holds a payout rather than rejecting it, because a false positive must not strand a merchant's money permanently (ADR-17).

Numbers

  • 30 provider files/day, up to 10 M lines each; 100% matched or broken within 24 h of receipt.
  • Unmatched value ≤ 0.01% of daily settled value; T+1 payout initiated by 06:00 local for 99.5% of eligible balances.
  • Trial balance produced and balanced daily, with no manual journal outside dual control. Stated assumptions.

Risks

  • A returned payout restores the balance, which means a merchant's available balance can go down after they have seen it go up. That is honest and it will generate support contacts.
◀  Money Going Back All views Merchant Notification by Event Class  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes across two in-country data centres · Payments Platform Architecture · 2026-10 · 24 views · 18 architecture decision records16-settlement-and-payout-pipeline