Building a payments ledger system

Square and Stripe never overwrite your balance. Not once. Moving $100 does not run an UPDATE. It appends two rows: alice -100, bob +100. The balance you see is replayed from that log. The balance column you would naively build is the wrong design. An overwrite destroys its own evidence: why is the number 300, did the debit land without the credit, what did alice have last Tuesday. So real ledgers enforce three rules. Every transaction sums to zero. UPDATE and DELETE are revoked at the database level. Balance is always SUM(entries). Even a refund is two new reversing rows, never an edit. Auditors do not trust systems that can erase. The idea is double-entry bookkeeping, 1494. Event sourcing, five centuries early. State is a cache. The log is the truth. I built a small ledger that refuses unbalanced transactions: Blog →https://lnkd.in/diKpFxhw Code →https://lnkd.in/dSEsspXh Please repost if you found it useful. Design attached below. #FinTech #Backend #SystemDesign #Databases

Payments are different from most AI problems because there’s no rollback. A model can revise a recommendation, but a payment commits. That constraint should drive how agentic systems are designed in finance. 1. Payments Need Multiple Agents, Not One Smart One In practice, payment execution breaks into distinct concerns, intent, consent, identity, risk, routing, execution, and exception handling. Each carries a different level of uncertainty and consequence. A multi-agent design lets each step operate with bounded authority, while the system maintains consistency through shared state and policy. This is far more resilient than a single agent trying to reason end to end. 2. Reasoning Must Be Structured, Not Just Longer Chain-of-thought is useful only if it’s constrained and inspectable. What matters isn’t that an agent “thinks,” but that its assumptions, constraints, and alternatives are explicit. Downstream agents need to validate or challenge that reasoning before execution. Free-form reasoning is fragile; structured reasoning survives production. 3. Evaluation Is a Runtime Control, Not a Report Autonomy can’t be static. Decision quality, risk proximity, outcome alignment, and confidence decay must continuously shape how much authority an agent has at any moment. Evaluations should act as live control signals, tightening limits, forcing escalation, or pulling humans back in when uncertainty rises. 4. Reinforcement Learning Belongs in Policy, Not the Ledger RL fits best where agents learn how to operate when to escalate, reroute, or pause, not where money actually moves. The goal isn’t to “learn payments,” but to refine decision policies under feedback without touching deterministic systems directly. 5. The Real Boundary Is Probabilistic to Deterministic Agents reason in probabilities. Ledgers require certainty. That boundary needs an explicit translation layer that collapses intent into a single, policy-valid instruction. Without it, uncertainty leaks into systems that demand finality. In my recent work, we implemented and validated, payments moved away from hard-coded flows. They now run as policy-governed execution paths fast, observable, and able to scale at machine speed without sacrificing determinism. Read More: https://lnkd.in/eV7nZEaK

Event Sourcing + GraphQL = match made in heaven. Here’s a concrete pattern. I recently designed a system like this for a client at Xolvio and wanted to share an anonymized version. It’s CQRS on AWS using Apollo GraphQL Federation (Router + subgraphs), Kurrent (EventStoreDB), and Stripe. The core idea is: • Writes are authoritative, append-only, and domain-driven (events). • Reads are fast, purpose-built projections (read models). • GraphQL is the composition layer that federates internal + external systems in one request. ⸻ WRITE side (Commands) 1. SPA hosted on S3 + CloudFront 2. Customer checks out via Stripe Checkout 3. Stripe webhook hits an Order Handler (Lambda) 4. Handler runs domain logic, then appends event to Kurrent 5. Kurrent connector triggers Orders Projector (Lambda) 6. Projector updates ReadModels (Aurora) with direct SQL The payment workflows stay in Stripe, and your domain stays clean with all the benefits of event sourcing. ⸻ READ side (Queries) 1. User opens their Orders page 2. Apollo Router receives a query that needs data from both your domain and Stripe 3. Router executes an optimal plan in parallel: • Orders subgraph reads from Aurora read models • Stripe subgraph fetches from Stripe APIs via Apollo Connectors 4. Router composes the result into a single response The UI makes one GraphQL query, and the router handles composition, latency hiding, and separation of concerns. ⸻ The "heaven" part, or what this buys you is: • Superior business intelligence (immutable events tell the whole story) • Perfect traceability (events are the ledger) • Fast UI (read models tuned for the page) • Clean integration (Stripe stays external; your domain stays yours) • No leaky abstraction (GraphQL composes, CQRS isolates) This is the pattern I reach for when the product needs a rock-solid domain core and a modern, composable API surface. Whaddayathink?

𝐌𝐨𝐬𝐭 𝐟𝐢𝐧𝐭𝐞𝐜𝐡𝐬 𝐝𝐨𝐧'𝐭 𝐡𝐚𝐯𝐞 𝐚 𝐫𝐞𝐜𝐨𝐧𝐜𝐢𝐥𝐢𝐚𝐭𝐢𝐨𝐧 𝐩𝐫𝐨𝐛𝐥𝐞𝐦. 𝐓𝐡𝐞𝐲 𝐡𝐚𝐯𝐞 𝐚 𝐭𝐫𝐮𝐭𝐡 𝐩𝐫𝐨𝐛𝐥𝐞𝐦. 👇 Every scaling fintech eventually hits the same wall. The PSP says the balance is $10,240. The spreadsheet says $10,198. The core system says something else entirely. Three numbers. One customer. Nobody can sign off on which one is right. That is not a tooling problem. It is an architecture problem. → Customer support sees one balance → Finance exports another → Risk tracks a third → Every close becomes a war room → Every new PSP adds its own mini-ledger → Every new market multiplies the chaos The root cause is always the same. There is no unified ledger at the core. 𝐖𝐡𝐲 𝐭𝐡𝐢𝐬 𝐤𝐞𝐞𝐩𝐬 𝐡𝐚𝐩𝐩𝐞𝐧𝐢𝐧𝐠 In early-stage builds, the transaction ledger is implicit. You store events in an app database. You mirror a provider's idempotency keys. You hope you can recompute a balance if anyone ever asks. That works until the product surface branches. Wallets. Treasury accounts. Marketplace payouts. Fees. Reserves. Compliance holds. Each one needs a slightly different view of the same money. Without a single source of truth, you don't get one. You get a truce that lasts until the next chargeback or duplicate webhook breaks it. 𝐖𝐡𝐚𝐭 𝐚 𝐮𝐧𝐢𝐟𝐢𝐞𝐝 𝐥𝐞𝐝𝐠𝐞𝐫 𝐜𝐡𝐚𝐧𝐠𝐞𝐬 → PSPs, banks, and reports feed in. They don't own truth anymore → User, merchant, settlement, and float balances all derive from one posting model → Reconciliation becomes validation, not investigation → New products and rails plug in without re-platforming → Audit trails are queryable, not reconstructed in a two-week sprint 𝐇𝐨𝐰 𝐦𝐨𝐧𝐞𝐲 𝐚𝐜𝐭𝐮𝐚𝐥𝐥𝐲 𝐦𝐨𝐯𝐞𝐬 𝐭𝐡𝐫𝐨𝐮𝐠𝐡 𝐢𝐭 1. Authorization. Hold placed. 2. Capture. Fee deducted. 3. Clearing. Network settles. 4. Settlement. Money transferred. 5. Complete. Merchant paid. With an optional dispute or reversal path that posts as a linked reversal. Not a mystery row in a different system. Real-time rails removed the buffer. Multi-product platforms removed the simplicity. Sponsor banks and regulators are asking harder questions than they were two years ago. Fintechs that scale without a re-architecture in year three tend to invest in the ledger early. When the product is small enough that the cost is contained. The ones that don't pay it back later with interest, during a funding round or an audit. Reconciliation is the tax you pay when no unified ledger leads. So at what stage of growth should a fintech stop renting financial truth from its providers and own it at the core? Drop your take. — https://lnkd.in/epmv7gyR Source: DashDevs LLC · Igor Tomych The Payments Brews: https://lnkd.in/g5cDhnjC Connecting the dots in Payments... | Marcel van Oost #Fintech #Payments #Infrastructure #CoreBanking #Ledger

Core Banking 101: the living ledger behind every bank (Thought this might be helpful to some) If the mobile app is the storefront, the core is the stockroom and ledger. Its the system-of-record that knows who you are, what you hold, and where every dollar sits, in real time and auditable. What the core does -Open/maintain accounts (with KYC/AML) -Post transactions (real time or batch), preserve ordering, handle reversals -Accrue interest/fees; run EOD/month-end -Feed the GL, reconcile sub-ledgers, produce statements/reports -Connect to rails: ACH, wires, RTP/FedNow, cards What’s inside +Customer master (CIF) & product engine (deposits/lending) +Ledger/posting & limits +Payments interfaces & file gateways +Servicing/collections +Reporting/BI, GL integrations, audit +Scheduler/batch + event streams Incumbents vs. challengers Incumbents: Fiserv (Premier, DNA, Signature), FIS (Horizon, IBS, Profile), Jack Henry (SilverLake, CIF 20/20; Symitar), Finastra, Temenos Cloud-native: Mambu, Thought Machine (Vault), 10x, Nymbus, Tuum, Ohpen Hybrids: Finxact (Fiserv), Pismo (Visa), Zeta (card/core) What the core is not -Digital banking UX (Q2, Alkami, Backbase) -KYC/AML vendors (Alloy, Socure) -Card processors (FIS Worldpay, Fiserv, Global/NUVEI, Marqeta) -BaaS orchestration (Unit, Synctera)-- these sit around or above cores How to evaluate (fast test) -Time to launch new products -Real-time posting + API throughput/latency SLAs -Data access: SQL/CDC/event streams into your warehouse -Payments coverage incl. ISO 20022 -Customization: config vs. code forks (upgradeable?) -Reliability: HA, RTO/RPO, EOD window -Ecosystem: prebuilt adapters (KYC, fraud, card, digital, treasury) -Observability: tracing, auditability, idempotency -Security & compliance pack, examiner track record -Commercials: pricing, exit terms, sandbox quality Migration playbook 1.Precise product/data mapping 2.Parallel run with strict reconciliation 3.Cutover: big-bang vs. strangler 4.Back-out plans, freeze windows, dual posting Trends shaping choices >Real-time everything → event-driven cores >Composable “core + payment hub + card core” >Low-code product factories to ship faster >Cloud pragmatism: multi-tenant for speed; single-tenant for control >First-class data: stream to the lakehouse for risk, CX, ops >Ledger as an API Borrow from trading stacks: Positions: balances/limits/holds as lifecycle positions; APIs/webhooks. Pre-commit: policy-as-code for KYC/KYB, sanctions, fraud, limits. Events: exactly-once posting; derive later. Netting/batching to save cost. Observability: corr IDs, SLOs, retries. Bottom line The core is the bank’s brain and books. Choose for speed, real-time reliability, data freedom, and an upgradeable path or switchable path. Sign contracts contingent on product roadmaps. Everything else including channels, analytics, even AI gets easier when the core is clean. What are your thoughts? #CoreBanking #Fintech #BankTech #Payments #APIs #RTP #FedNow

Building a Payment Service from Scratch - What I Learned as a Founder When we started building the payment system at takeUforward, I thought it would be simple, just integrate Razorpay/Paypal and move on. But once we went deeper, it turned into a full product within a product. Payments are about reliability, data integrity, and how gracefully your system behaves under pressure. Here’s what we learned 👇 - Don’t build only for “plans”, design for plan entities in your schema so upgrades/bundles/emi’s/future standalone offerings are easier to integrate - Support multiple validity periods within the same flow. - Implement an Adapter Pattern so gateways like Razorpay, PayPal, or Stripe can be swapped without touching business logic. - Keep a transaction_id as the single source of truth and design every API around it (create, capture, refund, audit) - Log everything, and store gateway response for future auditing - Ensure idempotency for every payment and refund API - a single retry shouldn’t double charge a user - Run all external calls async using background jobs or message queues to avoid blocking the user flow - Integrate refund callbacks with GST reversal logic to maintain accurate tax credits - Implement signature validation and webhook verification to avoid spoofed callbacks - Support EMI and split payments, each transaction linked via a parent-child hierarchy - Build monitoring dashboards for transaction latency, failure rates, and P95 response times - Use feature flags to roll out new gateways or payment logic gradually - Integrate third party sales - Integrate other product sales on our platform, manage taxes for them. These things sound overkill at the start, until you hit scale and realize why systems like Stripe and Razorpay obsess over these details. 💡 Check out TUF+ - we’ve covered OOPs/LLD over there, along with everything needed for Interview Preparation. It’s your one-stop interview prep platform for DSA, LLD, Core CS and more. Use code STRIVER to get the maximum discount, valid for the next few hours only ⏰

I built a Expense Sharing System(#Splitwise) in a #Flipkart interview — here’s what the interviewer was really testing The round started simple: “Design an Expense Sharing System like Splitwise.” Okay… users, splits, ledger… all good. But then the real evaluation started. Every follow-up question was checking whether I think like a real backend engineer — not just someone who writes code. They were evaluating: ✔ Clean class design ✔ Extensibility ✔ Separation of responsibilities ✔ Evolution of thought while scaling the design Here’s the version that I had used to pass the interview Requirements 1️⃣ Add users who share expenses 2️⃣ A paying user can split an expense: - Equal - Exact - Percent 3️⃣ Maintain a running ledger: - Who owes whom 4️⃣ User can view balances: - All balances - Specific user balance 🎯 Design Patterns Used 1️⃣ Command Pattern → Clean, extendable CLI operations (ADD_USER, EXPENSE, SHOW) 2️⃣ Strategy Pattern → Easily introduce new split rules (Equal, Exact, Percent) 3️⃣ Factory Pattern → SplitFactory maps type → correct strategy 4️⃣ Service Layer Pattern → ExpenseService & LedgerService separate business logic cleanly 5️⃣ Domain Models → User, Expense, Split, SplitType follow Single Responsibility Principle (SRP) for clarity Follow this in every LLD interview 1️⃣ Start with the core workflow and make it runnable. 2️⃣ Show working output early, even if basic. 3️⃣ Use design patterns only when they actually solve a problem and when time allows for them. 4️⃣ Explain your reasoning aloud while coding the solution. 📌 If you want the complete Java 17 project with CLI + full ledger logic, comment Expense System and I’ll share the repo link. 🚀 Thanks for reading! If you’re exploring LLD or system design — let’s connect 🤝 with me here → https://lnkd.in/gRKz8mG9 #SystemDesign #LLD #Java #BackendEngineering #DesignPatterns #TechInterviews #OOP #CleanArchitecture #CodingInterviews

A new chapter on designing financial transaction architectures just dropped in the early release of my O'Reilly book "Designing Financial Data Architectures." Any operational financial system (take payments or trading, for example) is ultimately powered by a financial transaction system at its core. This chapter examines the underlying mechanics of how these systems are designed and structured, covering: → A detailed breakdown of financial transactions and their components → The key design principles behind transaction architectures → The core building blocks of a transaction processing system → How to design a robust financial transaction store → How modern financial ledger systems are structured and implemented It’s now available in the early release here: https://lnkd.in/dXmidvuJ #dataarchitecture #financialtransactions #ledger #transactionstore

My first day at a new treasury job was a stack of 150 A/P payments I had to release by hand, one at a time, across three different bank portals. That's the problem ISO 20022 solves.   So I went and got pain.001 working out of our ERP, and that stack of manual releases became three payment files. I've been working with these standards since 2008 — pulling CAMT statements over Swift, sending payment files to banks across 40 countries. ISO 20022 is not the new thing your LinkedIn feed says it is. It's roughly two decades old. The deadlines are just what's finally forcing the conversation. The phrase everyone repeats is "richer data." Far fewer say what's inside it. So here's the practitioner version of what that payload gives you, and what it asks of you in return.   On the payment you send (pain.001): structured addressing instead of free-form lines, legal entity identifiers for the parties in the chain, purpose codes from the ISO code list, intermediary bank detail, real contact details so the bank knows who to call, and structured remittance — invoice number, due date, discount, amount — that drives straight-through reconciliation.   On the reporting you get back (CAMT.053 prior day, CAMT.052 current day): deeper transaction detail than BAI2 or MT940 will ever carry, embedded FX detail (transaction currency, rate, contract number), ultimate debtor and creditor, and ISO transaction codes. One quirk worth knowing — amounts in ISO are never signed; a separate credit/debit indicator does that work.   Two things on my radar heading into next year: Structured addressing. The free-form address line is being retired in the November 2026 SWIFT release. Cleaning up beneficiary and supplier addresses in your ERP and TMS is going to be the biggest lift, so start now.   Legal Entity Identifiers. In some jurisdictions an active LEI is becoming mandatory for certain outbound payment types. I learned this one the hard way: during a post-acquisition entity cleanup I let an entity's LEI lapse, and a seven-figure tax refund out of India got held up about six weeks, because India requires an active LEI on the beneficiary of an outbound cross-border payment. Get LEIs for your own entities, and start collecting them from suppliers, partners, counterparties and customers.   One more, because it sets the tone for the whole effort: ISO 20022 is a treasury and business initiative, not something to throw over the wall to IT. And APIs ride alongside all of it — the API is the transport layer, ISO is the data format, and they go hand in hand.   The payoff is the thing I wanted on day one staring at those 150 payments: the deepest data payload you can capture, driving reconciliation, fraud and KYC screening, regulatory reporting, and real analytics. The deadlines are just what's getting everyone started.