When an AI agent spends your money, "the user said so" is not evidence. A signed mandate chain is.
A deep dive on the mandate chain as evidence: verifiable credentials (VCs), signing, the non-repudiable Intent→Cart→Payment chain, revocation and expiry, and why this replaces 'trust me, the user said so' with cryptograp…
How to model the card payment as a two-phase auth-then-capture flow plus a clearing tail — handling incremental auths, partial captures, reversals, expiry, and the auth-vs-settled reconciliation that trips up every ledger.
Teaches how to model the card transaction as a two-phase (auth then capture) plus clearing/settlement state machine, handling partial captures, incremental auths, auth expiry/reversal, and the auth-vs-settled amount reconciliation.
Wiring the 3DS Server, Directory Server, and issuer ACS into a handshake that produces a cryptogram your authorization message can carry.
Teaches how to integrate 3-D Secure 2: the 3DS Server, Directory Server and issuer ACS handshake, frictionless vs challenge decisioning, device data collection, and liability-shift outcomes feeding the authorization.
How a token vault and scheme-issued network tokens push the raw PAN out of your application systems, so most of your services fall out of PCI-DSS scope entirely.
Teaches how a token vault and network tokens (TR-31/EMV payment tokens) remove PAN from application systems, cutting PCI-DSS scope, and how token provisioning, cryptograms, and detokenization boundaries are architected.
How three cryptographically signed mandates turn an agent's purchase into a non-repudiable audit trail.
Google's open Agent Payments Protocol (AP2).
How to engineer SEPA SCT and SDD flows: mandate lifecycle storage, pre-notification timing, FIRST/RCUR sequence types, and the R-transaction taxonomy modeled as an explicit state machine.
Teaches how to engineer SEPA SCT and SDD flows: mandate lifecycle storage, pre-notification timing, FIRST/RCUR sequence types, and the R-transaction taxonomy (reject/return/refund/reversal/revocation) as a state machine.
How to parse legacy MT103/MT202 fields, map them to MX pacs equivalents during coexistence, and thread a gpi UETR end-to-end so a cross-border payment stays trackable across correspondent hops.
Teaches how to parse legacy MT103/MT202 fields, map them to MX pacs equivalents during coexistence, and thread a gpi UETR end-to-end so a cross-border payment is trackable across correspondent hops.
How to engineer for 24x7 irrevocable instant credit — synchronous ISO 20022 messaging, request-for-payment flows, and idempotent liquidity checks with no batch cutoff.
Teaches how to build for 24x7 irrevocable instant credit: synchronous ISO 20022 request/response, request-for-payment (RfP) flows, credit-transfer timeouts, and idempotent liquidity checks at the rail with no batch cutoff.
The 40-year-old tag=value protocol still carrying most of the world's equity orders — and how to build an engine that survives a dropped connection.
How FIX session layer (logon, heartbeat, sequence-number gap-fill, resend) and application layer (NewOrderSingle, ExecutionReport) actually work, and how to build a resilient FIX engine.
How AI agents that discover, choose, and pay on your behalf break the assumptions baked into every checkout, and the protocol stack rushing in to fix them.
What agentic commerce is: AI agents that discover, select, and pay on a user's behalf.
How to treat pain, pacs, and camt as one typed, schema-driven domain instead of a pile of XML you concatenate by hand.
Teaches how to model, validate, and generate ISO 20022 XML payment messages (pain.001 initiation, pacs.008 interbank, camt.053 statements) with schema-driven typing, structured references, and idempotent message identifiers.
A field-by-field guide to decoding bitmaps, data elements, and MTI so a raw TCP frame becomes a typed auth request you can trust.
Teaches how to build a byte-level ISO 8583 encoder/decoder: primary/secondary bitmaps, data-element (DE) field definitions, MTI parsing, and stan/RRN correlation for card authorization messaging.
Model the fixed-width record hierarchy, warehouse entries until their effective date, and turn R-series returns into automated re-presentment.
Teaches how to build a NACHA file processor: fixed-width file/batch/entry/addenda record hierarchy, hash totals, effective-entry-date windows, and handling R-series return/NOC codes with automated re-presentment logic.
Talking to a payment rail is the least reliable part of your system. Treat every outbound call as fallible and every inbound webhook as hostile.
Talking to a payment rail is the least reliable part of your system. Treat every outbound call as fallible and reconcile on ambiguity; treat every inbound webhook as hostile — verify, dedupe, ack fast, and go read the truth.
A transfer is a state machine with money on the line. Model the states explicitly, reserve funds before you commit, and decide up front what an overdraft even means.
A transfer is a state machine with money on the line. Model the states explicitly, reserve funds before you commit, enforce invariants at every transition, and decide up front what an overdraft even means.
The first decision in any financial system, and the one people get wrong most often: never store money in a floating-point number.
Never store money in a float. Use integer minor units or fixed-scale decimals, round half-even, allocate so splits sum exactly, and treat currency and the FX rate you used as first-class, auditable data.
Settle securities delivery-versus-payment on T+2 through a central securities depository — the securities analog to FX PvP.
Settle securities delivery-versus-payment on T+2 through a central securities depository — the securities analog to FX PvP.
Model variable recurring payments and metered/subscription billing with proration, treating the mandate — not the retry loop — as the object that actually has state.
Model variable recurring payments and metered/subscription billing with proration, distinct from retry logic.
From BIN and program configuration through card production, HSM-backed PIN generation, and the real-time authorization controls engine.
Build the issuer side: BIN/program config, card production, PIN generation via HSM, and real-time authorization controls.
One reference model of every party in a card transaction — cardholder, merchant, gateway, acquirer/processor, scheme, and issuer — and the settlement path that moves the real money back the other way.
One reference map of who does what in a card payment: cardholder, merchant, gateway, acquirer/processor, scheme, issuer, and the settlement return path.
How a captured card transaction turns into money in a merchant's bank account — batching, gross-to-net fees, reserves, adjustments, and the T+N funding file.
From captured transactions to merchant bank account: batching, interchange/scheme-fee deduction, reserves/holdbacks, and T+N funding files.
Route a payment across multiple providers to maximize auth rate, with health-aware routing, failover, and normalized webhooks.
Route a payment across multiple PSPs to maximize auth rate, with health-aware routing, failover, and normalized webhooks.
Name-match the beneficiary before a push payment to stop authorized-push-payment (APP) fraud.
Name-match the beneficiary before a push payment to stop authorized-push-payment (APP) fraud.
Encode and decode EMVCo QR payloads (static vs dynamic), handle expiry, and reconcile QR-initiated payments.
Encode and decode EMVCo QR payloads (static vs dynamic), handle expiry, and reconcile QR-initiated payments.
How a foreign cardholder is offered payment in their home currency, who earns the FX margin, and how the choice threads through authorization and clearing.
How DCC offers a cardholder their home currency at point of sale, the FX markup and disclosure rules, and settlement implications.
How R2P flips the pull model into a request-and-approve flow, and the engineering behind mandates, consent, and reconciliation.
How Request to Pay (R2P) messaging works, the standing-mandate lifecycle, consent, and variable recurring payment authorization.
Designing a closed-loop wallet from the ledger up: double-entry balances, the money lifecycle, safeguarding client funds 1:1, and the engineering that keeps top-ups, holds, and reconciliation honest.
Designing a closed-loop wallet: top-up, hold, spend, refund, safeguarding of e-money, and the double-entry ledger behind a balance.
How Original Credit Transactions move money onto a card in near real time — and why pushing is a different animal from pulling.
How OCT/push-to-card (Visa Direct, Mastercard Send) moves money to a card in near real time, eligibility/limits, and reversal handling.
A clear-eyed look at trust models, who signs what, rails, credential handling, and settlement — and why these four overlap more than they compete.
A clear-eyed comparison across trust model, who signs what, payment rails supported, credential handling, settlement, and best-fit use cases.
How Visa Account Updater and Mastercard Automatic Billing Updater keep stored credentials alive when cards get reissued, expire, or change numbers.
How VAU/ABU keep stored credentials current, credential-on-file mandates, and reducing involuntary churn from expired/reissued cards.
Four protocols, four jobs: how tools, agent-to-agent messaging, and payment rails compose into one buying flow.
How the layers compose: MCP gives an agent tools and context; A2A lets agents talk to each other; AP2/ACP/x402 are the payment rails those agents call when money must move.
Why "authorize then capture" is a lie, and how to model a hold that grows, shrinks, expires, and reconciles against a moving available balance.
Pre-auth vs estimated vs incremental authorization (hotels, fuel, delivery), partial approvals, and reconciling holds against final capture.
The surface a store must expose when the buyer is an AI agent, not a browser — and why it is the fintech reliability playbook wearing a new hat.
What a store must expose to sell to agents: a machine-readable product feed/catalog, agentic checkout endpoints, acceptance of delegated payment tokens, idempotency keys for retried agent calls, webhooks for async status…
How a network authorizes on the issuer's behalf when the issuer host is unreachable — and how the books get squared afterward.
How the network authorizes on the issuer's behalf during downtime using stand-in rules and limits, then reconciles advices when the issuer returns.
When software holds the card and clicks "buy," the old questions — was this the cardholder, did they mean to, who pays if not — all get harder to answer.
The new fraud surface: prompt injection turning a shopping agent into an attacker's buyer, hijacked delegated credentials (Visa saw ~450% more dark-web 'AI Agent' chatter in H1 2026), and disputes when an agent acted on…
How a chip card proves it is genuine on every single transaction — and why a cloned magstripe never could.
How the chip generates an ARQC, the issuer validates it and returns an ARPC, plus offline data authentication (SDA/DDA/CDA) and terminal risk management.
How an AI agent turns a shopper's intent into a settled purchase, and where ACP and AP2 plug into the same eight-stage skeleton.
A complete walkthrough: product discovery via an AI surface → cart assembly → user approval/mandate → delegated payment token → merchant checkout → authorization → fulfillment → receipts/webhooks.
How decline-code classification, backoff scheduling, retry budgets, and network-token refresh recover subscription revenue without hammering the rails.
Teaches how to build a smart retry/dunning system: decline-code classification (hard vs soft), backoff and retry-window scheduling, retry-budget limits, and network-token refresh to recover subscription revenue.
When software spends money on your behalf, the merchant has to answer two questions before the charge clears: which agent is this, and what did the human actually let it do.
How a merchant verifies WHICH agent is acting and WHAT it may do.
Architecting platform balances, commission splits, delayed payouts, and negative-balance recovery without ever losing a cent.
Teaches how to architect marketplace money movement: platform vs connected-account balances, fee/commission splits, delayed payouts, negative-balance handling, and merchant-of-record vs facilitator models.
How to build escrow and conditional hold/release — segregated ledger accounts, release conditions and approvals, partial releases, and expiry auto-refund that never strand money.
Teaches how to build escrow and conditional hold/release: segregated escrow ledger accounts, release conditions/approvals, partial releases, and expiry auto-refund with double-entry safety.
How Visa and Mastercard are reshaping tokenization so an AI agent can pay on your behalf — with scoped credentials, agent-aware identity, and the network doing what it has always done: authenticate, authorize, tokenize.
How the card networks are adapting tokenization for agents.
How Coinbase revived a dormant status code so software agents can pay for what they use, one request at a time.
Coinbase's x402 revives the dormant HTTP 402 Payment Required status code so agents pay for resources machine-to-machine.
Two ways to move interbank money, and the engineering tradeoff that decides which one you build: settle every payment gross and pay in liquidity, or net at a window and carry settlement risk.
Teaches the engineering tradeoffs between gross real-time settlement and deferred net settlement: liquidity vs finality, queue/gridlock resolution in RTGS, and settlement-risk windows in DNS.
Reconciling correspondent-bank balances with mirror-account bookkeeping, camt.053 matching, value-date breaks, and unreconciled-item aging.
Teaches how to reconcile correspondent-bank nostro/vostro balances: mirror-account bookkeeping, expected-vs-actual statement (camt.053) matching, value-date breaks, and unreconciled-item aging.
How matched-leg submission, net pay-in scheduling, and conditional simultaneous settlement remove Herstatt risk from cross-currency trades.
Teaches how payment-versus-payment settlement eliminates Herstatt (principal) risk in FX: matched trade submission, pay-in schedules, simultaneous conditional settlement, and pay-out with net funding.
How Stripe and OpenAI turned "buy it for me" into an open standard — product feeds, delegated payment tokens, and OAuth consent.
The Agentic Commerce Protocol co-developed by Stripe and OpenAI that powers Instant Checkout in ChatGPT.
Turn card transaction attributes into interchange, scheme, and markup lines that reconcile to the cent.
Teaches how to build a deterministic fee engine that classifies each transaction into an interchange category (regulated debit, rewards, CPS qualification) and computes interchange + scheme + acquirer markup for merchant statements.
How to turn thousands of gross obligations into the fewest net positions per counterparty — with deterministic cutoff snapshots, netting cycles, and net-debit-cap enforcement.
Teaches how to build a netting engine that collapses many gross obligations into minimal net settlement positions per counterparty, handling netting cycles, cutoff snapshots, and net-debit-cap enforcement.
Modeling the full card dispute lifecycle with reason codes, evidence deadlines, representment, arbitration, and provisional-credit ledger entries at every transition.
Teaches how to model the full card dispute lifecycle as a state machine with reason codes, evidence deadlines, representment, pre-arbitration and arbitration, and provisional-credit ledger entries at each transition.
The transaction engine had to absorb 30K+ TPS across partner integrations, never lose a transaction, and survive partial failures. The architecture: Go, Kafka, Pub/Sub, Redis, K8s, with idempotency at every layer.
A single layer of idempotency will eventually fail. Three independent layers gives you a margin. Here is the pattern that worked across ingest, worker, and emit boundaries.
UPI, IMPS, NEFT, RTGS — which rail depends on amount, urgency, and success history. A deterministic chooser with a HITL gate for high-value transactions.
UPI is the most popular payment rail in India. The spec is precise. The implementation guides are not. Notes on the integration details that ate weeks the first time.