PCI scope is an architecture decision. You make it in week one.

A balance isn’t a column. The moment a mutable integer represents what someone is owed, two concurrent writes will eventually disagree with the truth, and you find out at month end with no way to reconstruct what happened. Double entry is the only defensible model: every movement writes two or more entries that sum to zero within a currency, and you derive the balance by summing them. Entries are append-only. Nothing gets updated or deleted, and you correct a mistake with a compensating reversal that leaves both the error and the fix visible forever.

Money is an integer in minor units with the currency stored beside it, and never a float. The exponent isn’t always two. JPY has none; KWD, BHD and JOD have three. A hardcoded multiplication by one hundred is a bug waiting for its first customer in Tokyo. When you split an amount, allocate the remainder deliberately so the parts sum exactly to the whole, instead of rounding each share on its own and losing a unit per transaction. For anything cross-border, capture the FX rate, its source, its timestamp and the quote identity at the moment it applied. Authorisation-time rate and capture-time rate are different numbers, and the difference belongs in its own ledger account rather than quietly inside revenue.

Every write path takes an idempotency key, stored with the response it produced and a unique constraint that makes a replay return the original result instead of moving money twice. Webhooks are at-least-once and arrive out of order, so exactly-once is an illusion you build on top of them: deduplicate on event identity, gate handlers on the object version rather than assuming arrival order is causal order, and re-fetch the object instead of trusting the payload. Authorisation, capture and settlement are three distinct states with their own timers, partial captures and expiries, and collapsing them into one boolean is the most common data-model mistake in this vertical.

Then reconciliation, as a first-class scheduled job with alerting rather than a spreadsheet somebody opens in January. A three-way match between your ledger, the processor settlement file and the bank statement catches what every other control misses: fees you never modelled, a refund that landed twice, reserve holds, payout timing, a chargeback that silently reversed a transaction you still show as complete. It’s unglamorous, it’s the difference between a product and a liability, and it’s the same engineering discipline behind our Next.js and TypeScript platform work.

KYC and AML onboarding is an asynchronous state machine wearing a form. A customer sits in pending, then documents-requested, then vendor-review, then manual-review or approved, and the transitions arrive as callbacks hours or days later from an identity or screening provider. Model it as a state machine on day one, or retrofit one under pressure. Sanctions screening isn’t a signup-time check either. The OFAC, EU, UN and UK lists change, so you rescreen the whole customer base on a schedule, recording every hit, disposition and reviewer.

Disputes are where missing data becomes money. Representment deadlines run in days, and the evidence that wins can only come from fields captured at authorisation: device fingerprint, IP, address and card-verification results, delivery confirmation, the authentication outcome. If you didn’t log it then, the dispute is unwinnable, and you pay the transaction plus the fee. Audit logs outlive the transaction by years. PCI DSS wants twelve months retained with three immediately available and clocks synchronised across the estate, while EU anti-money-laundering record keeping runs to five years after the relationship ends. Those are two different clocks on the same data, and you have to design them together.

Transaction monitoring is the one place in this vertical where a model genuinely belongs, and also the one place where an unexplainable model becomes a regulatory problem rather than an engineering preference. A freeze or a decline is an adverse decision a customer can contest, so every alert needs a reason code, the feature attributions behind it, the model version, and a stored snapshot of the inputs, with a human review path attached. That’s how we’d build the pipeline in an AI automation engagement, and whether a model is even the right tool for a given alert class is what an AI readiness assessment exists to answer before anyone writes a training pipeline.