# Solution Architecture Document ## Real-Time Core Payment Modernization & Instant Fraud Screening Engine Preliminary architecture recommendation Enterprise banking Architecture validation required Architecture perspective: Senior Technical Software Engineering Architect Domain: Retail & Corporate Banking — Real-Time Payments, Fraud Detection, Core Ledger Modernization Delivery constraint: 9 months Architecture classification: Hybrid, event-driven, active-active payment processing platform with controlled integration to the legacy core ledger. # 1. Understanding of the Request ## 1.1 Project overview The objective is to modernize the bank's existing payment infrastructure by introducing a real-time payment orchestration platform capable of processing domestic and international payment transactions, performing inline fraud and sanctions evaluations, and integrating with the existing IBM z/OS core banking ledger. The proposed platform must support: - 3,500 TPS baseline throughput. - 12,000 TPS peak throughput. - Less than 400 ms end-to-end API response time at p99. - Less than 80 ms allocated to parallel fraud scoring. - 99.999% availability. - Zero RPO and less than 60 seconds RTO. - Strict financial transaction idempotency. - PCI-DSS v4.0 security requirements. - Domestic data sovereignty. - Existing IBM MQ and CICS integration restrictions. - A fixed 9-month regulatory launch deadline. ## 1.2 Business problems being addressed | Existing challenge | Proposed architectural outcome | | ------------------------------ | ------------------------------------------ | | Batch-based payment processing | Continuous real-time payment orchestration | | Delayed fraud identification | Inline fraud and sanctions screening | | Duplicate debit/credit risk | Durable transaction idempotency | | Mainframe capacity constraints | Controlled asynchronous ledger integration | | Overnight reconciliation | Continuous and end-of-day reconciliation | | Limited payment visibility | Event-driven transaction observability | | Legacy infrastructure coupling | Decoupled payment orchestration layer | ## 1.3 Primary architectural objective The architecture must achieve an important separation: The payment processing platform should absorb transaction traffic, enforce payment controls, and coordinate financial transactions without exposing the legacy mainframe directly to consumer traffic. The mainframe remains the existing core accounting system, while the new platform handles payment orchestration, transaction state, fraud evaluation, routing, and controlled ledger integration. However, there is one critical distinction: > Decoupling the mainframe from payment traffic does not automatically solve financial consistency. The new platform must establish a formally approved mechanism for balance reservations, transaction commitments, and ledger posting. This is the most important architectural decision in the entire project. ## 1.4 Scope | Capability | Scope | | ----------------------------------------- | --------------------------------------------- | | Payment ingestion | Included | | ISO 20022 processing | Included | | Domestic payment schemes | Included | | Cross-border payments | Included | | Fraud screening | Included | | Sanctions screening | Included | | Payment orchestration | Included | | Idempotency | Included | | Balance reservation | Included, subject to ledger design validation | | Core ledger integration | Included | | Reconciliation | Included | | Audit and compliance | Included | | Operational monitoring | Included | | Customer-facing mobile application | Not specified | | Customer-facing internet banking frontend | Not specified | | Corporate banking frontend | Not specified | # 2. Confirmed Inputs ## 2.1 Business requirements | Requirement | Confirmed | | ----------------------------------- | --------- | | Real-time payment processing | Yes | | Domestic and international payments | Yes | | Inline fraud screening | Yes | | Real-time sanctions screening | Yes | | Duplicate transaction prevention | Yes | | Balance hold orchestration | Yes | | Legacy core ledger synchronization | Yes | | Automated reconciliation | Yes | | ISO 20022 support | Yes | ## 2.2 Existing technology stack | Architecture layer | Existing technology | | -------------------------- | ------------------------ | | On-premises infrastructure | Red Hat OpenShift | | Cloud infrastructure | Microsoft Azure | | Event streaming | Apache Kafka | | Core banking | IBM z/OS | | Mainframe integration | IBM MQ and CICS | | Regulatory reporting | Oracle Exadata | | Cryptographic security | On-premises HSM | | Architectural patterns | EDA, Outbox, Sagas, CQRS | ## 2.3 Confirmed constraints 1. Mainframe integration must use IBM MQ and CICS. 2. Mainframe direct processing must remain within its 800 concurrent TPS constraint. 3. Customer PII, balance data, and payment logs must remain within domestic borders. 4. Payment signing must use on-premises HSM infrastructure. 5. Peak processing capacity must reach 12,000 TPS. 6. The system must support active-active dual-region deployment. 7. Production regulatory launch must occur within nine months. ## 2.4 Initial architecture assessment ## Architectural feasibility assessment Payment orchestration Feasible Kafka-based decoupling Suitable Inline fraud screening Feasible with validation Mainframe protection Feasible Exactly-once financial effects Requires design validation Zero RPO active-active Requires infrastructure validation Five-nines end-to-end availability Requires dependency validation These are preliminary engineering assessments, not production certification or measured performance results. # 3. Not Specified / Assumptions / Clarifications Needed Several important architectural details remain undefined. These should be resolved through architecture discovery rather than assumed during implementation. ## 3.1 Critical missing requirements | Area | Missing information | Architectural impact | Priority | | ----------------------- | ------------------------------------------------------------------- | ------------------------------------------------------ | -------- | | Balance ownership | Which system owns available balance and holds? | Determines financial consistency model | High | | Ledger posting | Does CICS support idempotent posting and transaction inquiry? | Determines recovery and duplicate prevention | High | | Ledger throughput | Is 800 TPS concurrent capacity or sustained transaction throughput? | Determines throttling and backlog sizing | High | | Payment semantics | Is payment acceptance synchronous or asynchronous? | Determines API response contract | High | | Settlement | Scheme-specific clearing and settlement obligations | Determines orchestration and reconciliation | High | | Regional architecture | Physical locations and inter-region latency | Determines active-active consistency design | High | | Fraud model | Model serving technology, size, inference capacity | Determines latency and deployment architecture | High | | Sanctions provider | Internal engine or third-party provider? | Determines latency, availability and data residency | High | | Payment volumes | Average transaction size, daily volume and burst duration | Determines capacity planning | High | | HSM capacity | Signing throughput, clustering and failover capabilities | Determines cryptographic bottlenecks | High | | Payment schemes | Exact domestic and cross-border schemes | Determines adapter implementation | High | | Regulatory jurisdiction | Applicable banking and payment regulations | Determines compliance architecture | High | | Availability definition | Whether 99.999% applies to API, payment acceptance, or completion | Determines SLO and dependency budget | High | | Team structure | Engineering and operational team size | Determines delivery feasibility | Medium | | Budget | Infrastructure and licensing budget | Determines deployment economics | Medium | | Retention | Payment, fraud and audit retention periods | Determines storage architecture | Medium | | Corporate workflows | Approval limits, maker-checker and bulk payments | Determines domain complexity | Medium | | Customer interfaces | Existing channels and API consumers | Determines API gateway and authentication requirements | Medium | ## 3.2 Important architectural assumptions The following assumptions are provisional and must be explicitly approved. | ID | Assumption | Implication | | -- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | A1 | Mainframe remains the authoritative core accounting ledger | New platform maintains operational payment state, not an independently authoritative replacement ledger | | A2 | Payment processing state can be persisted outside the mainframe | Requires a durable transactional database | | A3 | MQ provides durable messaging and supports recoverable message processing | MQ persistence, acknowledgement and transaction configuration must be validated | | A4 | Both regions operate within the permitted domestic jurisdiction | Cross-region replication is legally permissible | | A5 | The bank can deploy synchronous replication or consensus for critical financial state | Required for zero data loss under the agreed failure model | | A6 | Fraud and sanctions engines can be hosted within domestic infrastructure | Required for data residency and latency | | A7 | Payment schemes provide duplicate detection or transaction-status inquiry mechanisms | Supports safe recovery of uncertain outbound payments | Important: A1 and A2 do not establish that an external payment control ledger can safely replace core-ledger balance checks. That capability requires an explicit accounting and risk-control decision. ## 3.3 Blocking architecture decisions Three questions should be answered before finalizing the detailed design: 1. Can the existing CICS account processing interface perform atomic balance reservation and release, or does it only support debit/credit postings? 2. Can the bank approve a strongly consistent payment control ledger that manages available funds and reservations independently of the mainframe's immediate balance view? 3. Is synchronous cross-region replication permitted within the required p99 latency and domestic data sovereignty constraints? Without these answers, the overall architecture can be designed, but financial consistency and zero-RPO guarantees cannot be certified. # 4. Technology Option Analysis ## 4.1 Architecture options considered Three viable architecture approaches are considered. ### Option A — Direct synchronous core-ledger integration [Deep Dive: A Guide to Modernizing Core Banking Systems](https://images.openai.com/static-rsc-4/Cmg718g5zpyNDbnvzew4JVdizrCPlRihsVEbgWJwSm7FFfLtb1u-WklWJ0CBwUHVcLiU-VAtkc999JwXMq_FYPhz0dXQxUqL7OQ3VqJScPlq7uKV70cgUkzcjbjOvCFxJhhtdLNa_73C51iP650auvQSGj0UJf0NDUxsp9kkKuQ?purpose=inline) [fintechwrapup.com](https://www.fintechwrapup.com/p/deep-dive-a-guide-to-modernizing?utm_source=chatgpt.com) Payment requests synchronously invoke the core banking system for balance checks, debit/credit posting, and transaction confirmation. Advantages - Mainframe remains the direct financial decision authority. - Fewer distributed consistency concerns. - Simpler accounting ownership. Disadvantages - Mainframe becomes the primary throughput bottleneck. - 12,000 TPS cannot be routed directly through a system constrained to 800 concurrent TPS. - Mainframe latency affects payment response time. - Reduced resilience during core banking degradation. Assessment: Not recommended as the primary architecture. ### Option B — Event-driven orchestration with a strongly consistent payment control store [How to use Kafka in system design interviews - A deep dive](https://images.openai.com/static-rsc-4/KvcDQm182LEdk6OetgjumxtkUN52JLwuDCKbdLMcpQHA_LfflarFr4jd2u5ygXR-SLVOSQZNIT6GbsZl8Sdi-3gBGUBEKuZi0TNSiCmjwe5Zl00cKwwn0IUTMp2zqTVOxDeL-aKdtwnjf-KJA1tX5ZwzXbIk-RdCSeiylxWo4ek?purpose=inline) [read.systemdesignblueprint.com](https://read.systemdesignblueprint.com/p/kafka-system-design-interview-guide?utm_source=chatgpt.com) A payment orchestration platform manages payment lifecycle state, idempotency, reservations and ledger posting coordination. The mainframe remains the accounting authority. The new platform maintains a durable operational record and, subject to bank approval, a strongly consistent representation of available funds and reservations. Advantages - Decouples incoming traffic from mainframe processing. - Enables horizontal scaling. - Supports controlled ledger posting. - Allows independent fraud and sanctions processing. - Supports durable recovery and reconciliation. Disadvantages - Requires distributed transaction coordination. - Introduces additional financial consistency responsibilities. - Requires careful account-level serialization. - More operational complexity than direct synchronous integration. Assessment: Recommended. ### Option C — Fully distributed microservices with independent financial services [Modernization of real-time payment orchestration on AWS | AWS Architecture Blog](https://images.openai.com/static-rsc-4/LaoUpkZcJyJwhlJLfE2fLZHQs4fKLYjrMWF7L8OPV6exHmprrFYXAMlHp-mSwjk08-iaDlJR_1_K_mVj1ZtbR5e92SzFXF0DlnJjNcSMDfuvSgtnUtZM4ZhYvit2vcyiGTRyn3zeIItsk-HtPEqXecXp9Dfqvvu7hWHrlEMYiyM?purpose=inline) [aws.amazon.com](https://aws.amazon.com/blogs/architecture/modernization-of-real-time-payment-orchestration-on-aws/?utm_source=chatgpt.com) Separate services independently own payment execution, account balances, risk, routing, settlement, ledger integration and reconciliation. Advantages - Independent scaling. - Independent deployment. - Strong domain separation. - Greater long-term organizational autonomy. Disadvantages - More distributed failure scenarios. - Increased deployment and monitoring complexity. - Higher engineering coordination overhead. - More difficult to deliver and stabilize in nine months. Assessment: Not recommended for the initial delivery. ## 4.2 Evaluation matrix | Criteria | Option A | Option B | Option C | | --------------------------- | --------------------------- | ----------------------------------- | --------------------------------- | | Scalability | Low | High | High | | Security | High potential | High potential | High potential | | Integration complexity | Medium | High | High | | Vendor lock-in | Medium | Medium | Medium | | Delivery effort | Medium | High | Very High | | Cost implication | Medium | Medium–High | High | | Operational maintainability | Medium | High with discipline | Medium | | Team skill fit | Depends on mainframe skills | Requires distributed systems skills | Requires broader specialist teams | | Mainframe protection | Low | High | High | | Nine-month suitability | Low | Medium–High with scope control | Low | ## 4.3 Recommended option Recommended  Option B: Event-driven payment orchestration with a strongly consistent payment control store. The implementation should use a modular application architecture with independently scalable critical workloads rather than immediately splitting every business capability into separate microservices. Suggested initial deployment boundaries: 1. Payment ingress and scheme adapters. 2. Payment orchestration. 3. Fraud and sanctions evaluation. 4. Account reservation and payment control. 5. Core ledger integration. 6. Reconciliation and reporting. These may initially be deployed as a small number of independently scalable applications with clear internal module boundaries. The architecture can evolve into more independent services when actual operational and organizational requirements justify it. # 5. Architecture Review ## 5.1 Review summary The proposed technology stack is directionally appropriate for the requirements. The existing infrastructure already provides several important enterprise capabilities: - OpenShift for container orchestration. - Kafka for high-volume event distribution. - IBM MQ for reliable mainframe integration. - CICS for controlled core banking transactions. - Oracle Exadata for regulatory and historical reporting. - HSM for cryptographic operations. - Azure for hybrid infrastructure and supporting cloud workloads. The main architectural concern is not the choice of technologies. It is how they will coordinate financial transactions across distributed systems. Overall assessment: Retain the existing technology investments and introduce a controlled payment orchestration and financial consistency layer. ## 5.2 Strengths and gaps | Architecture area | Existing implementation | Strengths | Gaps / recommendations | | ------------------------ | ------------------------- | ---------------------------------- | ---------------------------------------------------- | | Infrastructure | OpenShift + Azure | Hybrid deployment flexibility | Define regional failure domains | | Event streaming | Kafka | High-throughput event distribution | Define partitioning, replication and retention | | Mainframe integration | MQ + CICS | Existing enterprise integration | Define idempotent posting and recovery | | Data warehouse | Oracle Exadata | Regulatory reporting | Avoid using it as the operational transaction store | | Security | On-prem HSM | Strong key custody | Validate capacity and HA | | Application architecture | EDA, Sagas, CQRS | Appropriate patterns | Define ownership and transaction boundaries | | Fraud detection | ML-driven screening | Inline risk assessment | Model serving and fallback policies not specified | | Reconciliation | Automated EOD requirement | Financial control capability | Define intraday and exception reconciliation | | Disaster recovery | Active-active requirement | Improved availability potential | Strong consistency and failover design not specified | ## 5.3 Critical technical risks | Risk | Severity | Why it matters | Recommended action | | ----------------------------- | -------- | ------------------------------------------------- | ------------------------------------------------------ | | Inconsistent account balances | Critical | Can cause unauthorized spending | Implement approved balance reservation protocol | | Duplicate ledger postings | Critical | Can create financial loss | Durable idempotency and core posting references | | Kafka replay duplicates | High | Reprocessing may trigger repeated side effects | Idempotent consumers | | Mainframe overload | Critical | Can degrade core banking operations | Backpressure and controlled posting | | Cross-region split brain | Critical | Can cause conflicting account state | Consensus, fencing and single-writer account ownership | | Fraud engine timeout | High | Payment latency or risk exposure | Explicit fail-closed/fail-open policy | | HSM saturation | High | Payment signing becomes a bottleneck | Capacity test and HA validation | | Sanctions screening delay | High | Payment cannot safely proceed | Deadline-aware screening and controlled pending states | | Reconciliation mismatch | Critical | Unresolved financial differences | Independent transaction-level reconciliation | | Audit data loss | Critical | Regulatory and financial traceability compromised | Immutable audit storage and recovery validation | ## 5.4 NFR assessment The following distinguishes the targets supplied by the business from proposed engineering controls. | NFR | User-provided target | Architectural assessment | | ------------------ | ------------------------------- | ----------------------------------------------------------- | | Availability | 99.999% | Requires full dependency availability engineering | | Throughput | 3,500 TPS baseline; 12,000 peak | Requires load-tested horizontal scaling | | API latency | p99 under 400 ms | Requires latency budgets for every dependency | | Fraud latency | Under 80 ms | Parallel execution and bounded inference | | Recovery point | Zero | Requires synchronous durable replication for critical state | | Recovery time | Under 60 seconds | Requires tested automated failover | | Security | PCI-DSS v4.0 | Requires formal scope and compliance validation | | Data sovereignty | Domestic only | Requires regional data and backup restrictions | | Resilience | Not fully specified | Define failure handling and dependency isolation | | Maintainability | Not specified | Modular boundaries and engineering standards | | Observability | Not specified | End-to-end distributed tracing | | Backup and restore | Not specified | Define backup and recovery objectives | | Retention | Not specified | Regulatory retention and deletion policies | | Accessibility | Not specified | Relevant mainly to operational interfaces | | Cost efficiency | Not specified | Establish workload-based TCO model | | Support model | Not specified | Define 24/7 banking operations and escalation | ## 5.5 Improvement recommendations Immediate - Finalize financial transaction ownership. - Define payment state machine. - Establish idempotency contracts. - Validate IBM MQ/CICS posting capabilities. - Establish active-active consistency model. - Validate HSM throughput. - Define payment failure and reversal semantics. Short-term - Implement payment orchestration. - Establish operational transaction storage. - Implement fraud and sanctions integration. - Establish ledger posting workers. - Implement reconciliation and immutable audit trails. Long-term - Optimize ML model lifecycle. - Introduce additional payment schemes. - Improve predictive transaction monitoring. - Evolve independently deployable services where justified. - Introduce advanced fraud intelligence and network analytics. # 6. Recommended Architecture ## 6.1 Architecture overview ### Recommended architecture pattern A hybrid of: - Event-Driven Architecture. - Modular application architecture. - CQRS for appropriate read/write separation. - Transactional Outbox Pattern. - Saga orchestration. - Strongly consistent financial state management. - Controlled asynchronous core-ledger integration. Microservices should be introduced selectively, not universally. ### Core architectural layers | Layer | Responsibility | | --------------------- | --------------------------------------------------------- | | Channel and API layer | Receive and authenticate payment requests | | Payment ingress | Validate and normalize payment messages | | Payment orchestration | Manage payment lifecycle | | Risk evaluation | Fraud and sanctions checks | | Financial control | Idempotency, balance reservation and transaction controls | | Event streaming | Distribute payment lifecycle events | | Ledger integration | Control communication with IBM MQ/CICS | | Reconciliation | Compare payment and ledger outcomes | | Audit and reporting | Maintain immutable evidence and regulatory reporting | ### Critical design principle The architecture must distinguish between: 1. Payment acceptance. 2. Payment authorization. 3. Payment execution. 4. Ledger posting. 5. Scheme settlement. 6. Final reconciliation. These are different business states. A payment accepted by the API is not necessarily a payment successfully posted to the core ledger or settled through the payment network. ## 6.2 Frontend architecture Customer-facing frontend technology is not specified. I would not introduce a new frontend framework as part of the core payment modernization without a confirmed channel requirement. Recommended approach: | Component | Recommendation | | ------------------ | ------------------------------------------------------------------------- | | Retail banking | Existing digital banking channels | | Corporate banking | Existing corporate channels | | Payment API | REST/JSON and ISO 20022 integration contracts as appropriate | | Operations console | Web-based internal application | | State management | Restricted to operational UI requirements | | Authentication | Enterprise IAM integration | | Authorization | RBAC with ABAC for sensitive operational actions | | Accessibility | WCAG 2.2 AA as a proposed operational UI target, subject to applicability | The operational console should support: - Payment lifecycle search. - Transaction status investigation. - Fraud decision visibility. - Ledger posting status. - Reconciliation exceptions. - Controlled payment intervention. - Dual authorization for sensitive actions. No manual operation should bypass financial transaction controls. ## 6.3 Backend architecture ### Proposed backend technology The exact implementation language is not specified. Recommended evaluation: | Technology | Suitability | Assessment | | ------------------ | ----------- | --------------------------------------------------------------------------------------------------- | | Java + Spring Boot | High | Preferred candidate for enterprise payment services | | Quarkus | High | Alternative for container-oriented Java workloads | | .NET | High | Viable where enterprise engineering expertise supports it | | Node.js | Medium | Suitable for selected API workloads, not automatically preferred for the financial transaction core | Recommendation: Java with Spring Boot for the initial implementation, provided the bank has suitable Java engineering expertise. Reasons: - Established enterprise integration ecosystem. - Suitable support for Kafka and IBM MQ integration. - Strong transaction-processing and testing ecosystem. - Mature security and observability integrations. - Suitable for OpenShift deployment. This is a technology recommendation, not a requirement to use Spring Boot for every component. ### Proposed backend modules ## Payment platform application structure 1\. Payment Ingress Module ISO 20022 parsing · API validation · Scheme adapters · Authentication 2\. Payment Orchestration Module Payment lifecycle · State machine · Saga coordinator · Routing 3\. Risk Evaluation Module Fraud inference · Sanctions screening · Risk decision aggregation 4\. Financial Control Module Idempotency · Balance reservations · Account-level sequencing · Journal controls 5\. Core Integration Module MQ publishing · CICS transaction adapters · Posting acknowledgements · Retry and recovery 6\. Reconciliation Module Network reconciliation · Core ledger comparison · Exceptions · Settlement reporting Logical module boundaries. These do not imply six independently deployed microservices. ### Payment state machine The payment orchestration engine should maintain explicit and persisted transaction states. \#chatgpt-mermaid-\_r_3in\_{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;fill:rgb(13, 13, 13);}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#chatgpt-mermaid-\_r_3in\_ .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3in\_ .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3in\_ .error-icon{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3in\_ .error-text{fill:rgb(13, 13, 13);stroke:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ .edge-thickness-normal{stroke-width:1px;}#chatgpt-mermaid-\_r_3in\_ .edge-thickness-thick{stroke-width:3.5px;}#chatgpt-mermaid-\_r_3in\_ .edge-pattern-solid{stroke-dasharray:0;}#chatgpt-mermaid-\_r_3in\_ .edge-thickness-invisible{stroke-width:0;fill:none;}#chatgpt-mermaid-\_r_3in\_ .edge-pattern-dashed{stroke-dasharray:3;}#chatgpt-mermaid-\_r_3in\_ .edge-pattern-dotted{stroke-dasharray:2;}#chatgpt-mermaid-\_r_3in\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3in\_ .marker.cross{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3in\_ svg{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;}#chatgpt-mermaid-\_r_3in\_ p{margin:0;}#chatgpt-mermaid-\_r_3in\_ defs [id$="-barbEnd"]{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3in\_ g.stateGroup text{fill:rgb(83, 154, 248);stroke:none;font-size:10px;}#chatgpt-mermaid-\_r_3in\_ g.stateGroup text{fill:rgb(13, 13, 13);stroke:none;font-size:10px;}#chatgpt-mermaid-\_r_3in\_ g.stateGroup .state-title{font-weight:bolder;fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ g.stateGroup rect{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3in\_ g.stateGroup line{stroke:rgb(143, 143, 143);stroke-width:1;}#chatgpt-mermaid-\_r_3in\_ .transition{stroke:rgb(143, 143, 143);stroke-width:1;fill:none;}#chatgpt-mermaid-\_r_3in\_ .stateGroup .composit{fill:transparent;border-bottom:1px;}#chatgpt-mermaid-\_r_3in\_ .stateGroup .alt-composit{fill:#e0e0e0;border-bottom:1px;}#chatgpt-mermaid-\_r_3in\_ .state-note{stroke:rgb(107, 198, 127);fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3in\_ .state-note text{fill:rgb(13, 13, 13);stroke:none;font-size:10px;}#chatgpt-mermaid-\_r_3in\_ .stateLabel .box{stroke:none;stroke-width:0;fill:rgb(222, 234, 251);opacity:0.5;}#chatgpt-mermaid-\_r_3in\_ .edgeLabel .label rect{fill:rgb(222, 234, 251);opacity:0.5;}#chatgpt-mermaid-\_r_3in\_ .edgeLabel{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3in\_ .edgeLabel p{background-color:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3in\_ .edgeLabel rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3in\_ .edgeLabel .label text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ .label div .edgeLabel{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ .stateLabel text{fill:rgb(13, 13, 13);font-size:10px;font-weight:bold;}#chatgpt-mermaid-\_r_3in\_ .node circle.state-start{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3in\_ .node .fork-join{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3in\_ .node circle.state-end{fill:rgb(83, 154, 248);stroke:transparent;stroke-width:1.5;}#chatgpt-mermaid-\_r_3in\_ .end-state-inner{fill:transparent;stroke-width:1.5;}#chatgpt-mermaid-\_r_3in\_ .node rect{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3in\_ .node polygon{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3in\_ [id$="-barbEnd"]{fill:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3in\_ .statediagram-cluster rect{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3in\_ .cluster-label,#chatgpt-mermaid-\_r_3in\_ .nodeLabel{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ .statediagram-cluster rect.outer{rx:5px;ry:5px;}#chatgpt-mermaid-\_r_3in\_ .statediagram-state .divider{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3in\_ .statediagram-state .title-state{rx:5px;ry:5px;}#chatgpt-mermaid-\_r_3in\_ .statediagram-cluster.statediagram-cluster .inner{fill:transparent;}#chatgpt-mermaid-\_r_3in\_ .statediagram-cluster.statediagram-cluster-alt .inner{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3in\_ .statediagram-cluster .inner{rx:0;ry:0;}#chatgpt-mermaid-\_r_3in\_ .statediagram-state rect.basic{rx:5px;ry:5px;}#chatgpt-mermaid-\_r_3in\_ .statediagram-state rect.divider{stroke-dasharray:10,10;fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3in\_ .note-edge{stroke-dasharray:5;}#chatgpt-mermaid-\_r_3in\_ .statediagram-note rect{fill:rgb(243, 243, 243);stroke:rgb(107, 198, 127);stroke-width:1px;rx:0;ry:0;}#chatgpt-mermaid-\_r_3in\_ .statediagram-note rect{fill:rgb(243, 243, 243);stroke:rgb(107, 198, 127);stroke-width:1px;rx:0;ry:0;}#chatgpt-mermaid-\_r_3in\_ .statediagram-note text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ .statediagram-note .nodeLabel{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ .statediagram .edgeLabel{color:red;}#chatgpt-mermaid-\_r_3in\_ [id$="-dependencyStart"],#chatgpt-mermaid-\_r_3in\_ [id$="-dependencyEnd"]{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);stroke-width:1;}#chatgpt-mermaid-\_r_3in\_ .statediagramTitleText{text-anchor:middle;font-size:18px;fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].statediagram-cluster rect{fill:rgb(222, 234, 251);stroke:url(#chatgpt-mermaid-\_r_3in\_-gradient);stroke-width:1;}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].statediagram-cluster rect.outer{rx:5px;ry:5px;filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3in\_ .node .neo-node{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node rect,#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].cluster rect,#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node polygon{stroke:url(#chatgpt-mermaid-\_r_3in\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].swimlane.cluster rect{filter:none;}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node path{stroke:url(#chatgpt-mermaid-\_r_3in\_-gradient);stroke-width:1px;}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node .neo-line path{stroke:rgb(83, 154, 248);filter:none;}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node circle{stroke:url(#chatgpt-mermaid-\_r_3in\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].node circle .state-start{fill:#000000;}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].icon-shape .icon{fill:url(#chatgpt-mermaid-\_r_3in\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3in\_ [data-look="neo"].icon-shape .icon-neo path{stroke:url(#chatgpt-mermaid-\_r_3in\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3in\_ :root{--mermaid-font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";}RECEIVEDVALIDATEDRISK_PENDINGRISK_APPROVEDREJECTEDFUNDS_RESERVEDAUTHORIZEDSUBMITTEDCORE_PENDINGPOSTEDSETTLEMENT_PENDINGSETTLEDUNKNOWN_OUTCOMERELEASE_PENDINGCANCELLEDRETURN_PENDINGRETURNED The state machine is illustrative. Scheme-specific statuses, timeouts, rejection and reversal states must be added during detailed design. Important: `UNKNOWN_OUTCOME` is essential. A timeout after a request is sent to CICS does not establish that the transaction failed. The system must query or otherwise resolve the original transaction before retrying a financial side effect. ## 6.4 Integration architecture ### Proposed integration components | Integration | Communication | Responsibility | | ---------------- | ----------------------------------- | --------------------------- | | Banking channels | Synchronous REST | Payment initiation | | Payment schemes | Scheme-specific protocols | External payment execution | | Kafka | Asynchronous events | Internal event distribution | | IBM MQ | Durable messaging | Mainframe communication | | CICS | Controlled transactional processing | Core ledger operations | | Fraud engine | Synchronous parallel request | Risk scoring | | Sanctions engine | Synchronous request | Screening | | HSM | Secure cryptographic interface | Payment signing | | Oracle Exadata | Controlled data loading | Audit/reporting workloads | ### Integration architecture diagram \#chatgpt-mermaid-\_r_3iu\_{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;fill:rgb(13, 13, 13);}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#chatgpt-mermaid-\_r_3iu\_ .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3iu\_ .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3iu\_ .error-icon{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3iu\_ .error-text{fill:rgb(13, 13, 13);stroke:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ .edge-thickness-normal{stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .edge-thickness-thick{stroke-width:3.5px;}#chatgpt-mermaid-\_r_3iu\_ .edge-pattern-solid{stroke-dasharray:0;}#chatgpt-mermaid-\_r_3iu\_ .edge-thickness-invisible{stroke-width:0;fill:none;}#chatgpt-mermaid-\_r_3iu\_ .edge-pattern-dashed{stroke-dasharray:3;}#chatgpt-mermaid-\_r_3iu\_ .edge-pattern-dotted{stroke-dasharray:2;}#chatgpt-mermaid-\_r_3iu\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3iu\_ .marker.cross{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3iu\_ svg{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;}#chatgpt-mermaid-\_r_3iu\_ p{margin:0;}#chatgpt-mermaid-\_r_3iu\_ .label{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ .cluster-label text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ .cluster-label span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ .cluster-label span p{background-color:transparent;}#chatgpt-mermaid-\_r_3iu\_ .label text,#chatgpt-mermaid-\_r_3iu\_ span{fill:rgb(13, 13, 13);color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ .node rect,#chatgpt-mermaid-\_r_3iu\_ .node circle,#chatgpt-mermaid-\_r_3iu\_ .node ellipse,#chatgpt-mermaid-\_r_3iu\_ .node polygon,#chatgpt-mermaid-\_r_3iu\_ .node path{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .rough-node .label text,#chatgpt-mermaid-\_r_3iu\_ .node .label text,#chatgpt-mermaid-\_r_3iu\_ .image-shape .label,#chatgpt-mermaid-\_r_3iu\_ .icon-shape .label{text-anchor:middle;}#chatgpt-mermaid-\_r_3iu\_ .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .rough-node .label,#chatgpt-mermaid-\_r_3iu\_ .node .label,#chatgpt-mermaid-\_r_3iu\_ .image-shape .label,#chatgpt-mermaid-\_r_3iu\_ .icon-shape .label{text-align:center;}#chatgpt-mermaid-\_r_3iu\_ .node.clickable{cursor:pointer;}#chatgpt-mermaid-\_r_3iu\_ .root .anchor path{fill:rgb(143, 143, 143)!important;stroke-width:0;stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3iu\_ .arrowheadPath{fill:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3iu\_ .edgePath .path{stroke:rgb(143, 143, 143);stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .flowchart-link{stroke:rgb(143, 143, 143);fill:none;}#chatgpt-mermaid-\_r_3iu\_ .edgeLabel{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3iu\_ .edgeLabel p{background-color:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3iu\_ .edgeLabel rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3iu\_ .labelBkg{background-color:rgba(252, 252, 252, 0.5);}#chatgpt-mermaid-\_r_3iu\_ .cluster rect{fill:rgb(243, 243, 243);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .cluster text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ .cluster span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:12px;background:rgb(243, 243, 243);border:1px solid rgba(0, 0, 0, 0.1);border-radius:2px;pointer-events:none;z-index:100;}#chatgpt-mermaid-\_r_3iu\_ .flowchartTitleText{text-anchor:middle;font-size:18px;fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3iu\_ rect.text{fill:none;stroke-width:0;}#chatgpt-mermaid-\_r_3iu\_ .icon-shape,#chatgpt-mermaid-\_r_3iu\_ .image-shape{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3iu\_ .icon-shape p,#chatgpt-mermaid-\_r_3iu\_ .image-shape p{background-color:rgb(252, 252, 252);padding:2px;}#chatgpt-mermaid-\_r_3iu\_ .icon-shape .label rect,#chatgpt-mermaid-\_r_3iu\_ .image-shape .label rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3iu\_ .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#chatgpt-mermaid-\_r_3iu\_ .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#chatgpt-mermaid-\_r_3iu\_ .node .neo-node{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node rect,#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].cluster rect,#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node polygon{stroke:url(#chatgpt-mermaid-\_r_3iu\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].swimlane.cluster rect{filter:none;}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node path{stroke:url(#chatgpt-mermaid-\_r_3iu\_-gradient);stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node .neo-line path{stroke:rgb(83, 154, 248);filter:none;}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node circle{stroke:url(#chatgpt-mermaid-\_r_3iu\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].node circle .state-start{fill:#000000;}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].icon-shape .icon{fill:url(#chatgpt-mermaid-\_r_3iu\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3iu\_ [data-look="neo"].icon-shape .icon-neo path{stroke:url(#chatgpt-mermaid-\_r_3iu\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3iu\_ .node text{font-size:14px;font-weight:600;letter-spacing:normal;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3iu\_ .edgeLabels text{font-size:13px;font-weight:600;letter-spacing:-0.08px;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3iu\_ .node tspan[font-weight="normal"],#chatgpt-mermaid-\_r_3iu\_ .edgeLabels tspan[font-weight="normal"]{font-weight:600;}#chatgpt-mermaid-\_r_3iu\_ .edgeLabel .label rect{opacity:1;rx:13px;ry:13px;fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .node rect,#chatgpt-mermaid-\_r_3iu\_ .node circle,#chatgpt-mermaid-\_r_3iu\_ .node ellipse,#chatgpt-mermaid-\_r_3iu\_ .node polygon,#chatgpt-mermaid-\_r_3iu\_ .node path{fill:rgb(229, 243, 255);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3iu\_ .node rect{rx:16px;ry:16px;}#chatgpt-mermaid-\_r_3iu\_ .mermaid-decision .label-container{fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-dasharray:2,2;}#chatgpt-mermaid-\_r_3iu\_ .edgePaths .flowchart-link{stroke:rgb(143, 143, 143);stroke-width:1px;stroke-linecap:round;stroke-linejoin:round;}#chatgpt-mermaid-\_r_3iu\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3iu\_ :root{--mermaid-font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";}Retail and Corporate ChannelsAPI Gateway / IngressPayment Ingress and ISO20022 AdapterPayment OrchestratorFraud and Sanctions EvaluationFinancial Control ServiceTransactional Payment StoreTransactional OutboxEnterprise KafkaLedger Integration WorkerIBM MQCICSIBM z/OS Core LedgerOn-Prem HSMPayment SchemesReconciliationOracle ExadataHTTPSParallel callsCryptographic signingPayment submissionPosting confirmations The diagram represents logical communication paths. Specific scheme routing and the exact sequence of ledger posting versus network submission depend on the payment rail's authorization and settlement semantics. ### Retry strategy | Integration | Retry strategy | | ---------------- | ----------------------------------------------------- | | Fraud engine | Bounded retry within request deadline | | Sanctions engine | Bounded retry; no bypass without explicit policy | | Kafka | Consumer retry and dead-letter handling | | IBM MQ | Persistent messages and recoverable processing | | CICS | Resolve uncertain outcomes before resubmission | | HSM | Bounded retry where operation semantics permit | | Payment scheme | Scheme-defined duplicate detection and status inquiry | Avoid generic unlimited retries. Retries can increase load during outages and cause repeated financial side effects unless the downstream system supports idempotency. ### Idempotency design The idempotency mechanism should be implemented at multiple boundaries. | Boundary | Control | | ----------------------- | ------------------------------------- | | API ingress | Client-provided idempotency key | | Payment orchestration | Unique payment identifier | | Financial control | Unique reservation reference | | Kafka consumer | Event processing deduplication | | MQ/CICS | Unique posting reference | | External payment scheme | Scheme-specific transaction reference | Suggested database constraints: ``` CREATE TABLE payment_transaction ( payment_id VARCHAR(64) PRIMARY KEY, idempotency_key VARCHAR(128) NOT NULL, account_id VARCHAR(64) NOT NULL, payment_status VARCHAR(32) NOT NULL, amount DECIMAL(20, 4) NOT NULL, currency CHAR(3) NOT NULL, created_at TIMESTAMP NOT NULL, updated_at TIMESTAMP NOT NULL, CONSTRAINT uq_payment_idempotency UNIQUE (idempotency_key) ); ``` This is an illustrative schema. Production design must include tenant/customer scope, key expiration policy, request fingerprinting, payment references and currency precision rules. If an idempotency key is reused with a different payment payload, reject the request rather than returning the previous payment result as though it represented the new request. ## 6.5 Data architecture ### Recommended data storage | Data category | Recommended storage | Purpose | | --------------------------------- | ---------------------------------------------------------------- | ----------------------------------- | | Payment transaction state | Strongly consistent relational database | Operational financial state | | Balance reservations | Same transactional database initially | Atomic financial controls | | Account-level control state | Same transactional database initially | Available funds and sequencing | | Event distribution | Kafka | Payment lifecycle events | | Mainframe messages | IBM MQ | Core banking integration | | Audit evidence | Immutable WORM storage | Regulatory traceability | | Reporting and historical analysis | Oracle Exadata | Regulatory and historical reporting | | ML features | Domestic low-latency feature store or controlled feature service | Fraud inference | A relational database is recommended because the system requires: - Strong transactional guarantees. - Uniqueness constraints. - Atomic updates. - Financial decimal precision. - Durable transaction state. - Controlled account-level locking or sequencing. The exact database product is not specified. Selection must consider supported synchronous replication, regional failover, write consistency, operational maturity and licensing. ### Balance reservation design This is the most important data architecture component. A simplified account control model: ``` Account | +-- Ledger Balance | +-- Active Reservations | +-- Pending Debits | +-- Pending Credits | +-- Available Funds ``` Illustrative calculation: \\[ AvailableFunds = LedgerBalance - ActiveReservations - ApplicableDebits \\] The exact calculation must incorporate overdraft facilities, limits, uncleared funds, account restrictions and product-specific rules. For a payment request: 1. Obtain an account-level transaction ordering mechanism. 2. Verify that sufficient funds are available. 3. Create a unique reservation. 4. Persist the reservation and payment state atomically. 5. Publish the corresponding event using the outbox. 6. Execute the downstream payment workflow. 7. Confirm posting. 8. Release or consume the reservation according to the approved accounting protocol. Important financial limitation: If the mainframe is the sole authoritative source of available funds and does not support atomic reservations, the external payment control store cannot safely authorize spending based only on a stale replicated balance. A bank-approved shadow accounting model, transaction limits and exposure controls would be necessary. ### Transactional Outbox The outbox pattern prevents a critical dual-write problem. Without an outbox: ``` 1. Save payment in database. 2. Publish Kafka event. 3. Application crashes between operations. 4. Payment exists, but downstream systems never receive event. ``` With an outbox: ``` Single database transaction: Save payment state. Save outbox event. Separate publisher: Read committed outbox entries. Publish to Kafka. Mark event published. ``` Kafka delivery and consumers must still tolerate duplicate delivery. The outbox guarantees durable publication intent, not end-to-end exactly-once financial execution. ## 6.6 Security architecture ### Security model Adopt a Zero Trust-oriented security architecture, with identity verification, least privilege, network segmentation and continuous security monitoring. | Security layer | Recommendation | | --------------------- | ---------------------------------------------------- | | Authentication | Enterprise IAM and strong service identities | | Authorization | RBAC + ABAC | | API protection | Gateway validation, rate limits and request controls | | Service communication | Mutual TLS | | Data encryption | Encryption at rest and in transit | | Cryptographic keys | On-prem HSM | | Secrets | Enterprise secrets management | | Network security | Segmented trust zones | | Audit | Immutable, access-controlled audit records | | Administrative access | Privileged access management | | Workload security | Container image scanning and runtime protection | | Data privacy | Data minimization and masking | ### HSM architecture The HSM should remain a controlled cryptographic service. It should support: - Signing key custody. - Payment message signing. - Key rotation. - Cryptographic operation audit. - High availability. - Disaster recovery. - Controlled key administration. Private keys must not be exported into application containers. Performance dependency: The bank must validate HSM signing throughput at peak payment volume. If each transaction requires multiple cryptographic operations, capacity requirements must reflect the operation count, not simply payment TPS. ### Data sovereignty Domestic residency must apply to more than primary databases. It should cover: - Production databases. - Kafka topics and replicas. - MQ messages. - Logs and traces containing sensitive data. - Backups. - Disaster recovery copies. - Fraud features. - Support exports. - Administrative diagnostics. - Cloud object storage. - External ML or sanctions integrations. The bank must explicitly verify the permitted jurisdiction of Azure services, backup locations and operational support access. ### Audit architecture Every financial transaction should have a traceable audit chain. Recommended identifiers: - Payment ID. - Idempotency key. - Correlation ID. - Event ID. - Account reference. - Reservation ID. - Core posting reference. - Scheme transaction reference. - Fraud decision ID. - Reconciliation reference. Audit records should be append-only, tamper-evident, access-controlled and retained according to approved regulatory policies. Do not store unnecessary PAN or other sensitive authentication data in general application logs. ## 6.7 Infrastructure and deployment architecture ### Recommended infrastructure model Retain OpenShift as the primary application platform. Use Azure for approved supporting capabilities where the services meet residency, latency, security and operational requirements. Do not move latency-sensitive or HSM-dependent operations into an unvalidated cloud execution path. ### Active-active architecture \#chatgpt-mermaid-\_r_3jm\_{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;fill:rgb(13, 13, 13);}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#chatgpt-mermaid-\_r_3jm\_ .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3jm\_ .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3jm\_ .error-icon{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3jm\_ .error-text{fill:rgb(13, 13, 13);stroke:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ .edge-thickness-normal{stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .edge-thickness-thick{stroke-width:3.5px;}#chatgpt-mermaid-\_r_3jm\_ .edge-pattern-solid{stroke-dasharray:0;}#chatgpt-mermaid-\_r_3jm\_ .edge-thickness-invisible{stroke-width:0;fill:none;}#chatgpt-mermaid-\_r_3jm\_ .edge-pattern-dashed{stroke-dasharray:3;}#chatgpt-mermaid-\_r_3jm\_ .edge-pattern-dotted{stroke-dasharray:2;}#chatgpt-mermaid-\_r_3jm\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3jm\_ .marker.cross{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3jm\_ svg{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;}#chatgpt-mermaid-\_r_3jm\_ p{margin:0;}#chatgpt-mermaid-\_r_3jm\_ .label{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ .cluster-label text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ .cluster-label span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ .cluster-label span p{background-color:transparent;}#chatgpt-mermaid-\_r_3jm\_ .label text,#chatgpt-mermaid-\_r_3jm\_ span{fill:rgb(13, 13, 13);color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ .node rect,#chatgpt-mermaid-\_r_3jm\_ .node circle,#chatgpt-mermaid-\_r_3jm\_ .node ellipse,#chatgpt-mermaid-\_r_3jm\_ .node polygon,#chatgpt-mermaid-\_r_3jm\_ .node path{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .rough-node .label text,#chatgpt-mermaid-\_r_3jm\_ .node .label text,#chatgpt-mermaid-\_r_3jm\_ .image-shape .label,#chatgpt-mermaid-\_r_3jm\_ .icon-shape .label{text-anchor:middle;}#chatgpt-mermaid-\_r_3jm\_ .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .rough-node .label,#chatgpt-mermaid-\_r_3jm\_ .node .label,#chatgpt-mermaid-\_r_3jm\_ .image-shape .label,#chatgpt-mermaid-\_r_3jm\_ .icon-shape .label{text-align:center;}#chatgpt-mermaid-\_r_3jm\_ .node.clickable{cursor:pointer;}#chatgpt-mermaid-\_r_3jm\_ .root .anchor path{fill:rgb(143, 143, 143)!important;stroke-width:0;stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3jm\_ .arrowheadPath{fill:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3jm\_ .edgePath .path{stroke:rgb(143, 143, 143);stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .flowchart-link{stroke:rgb(143, 143, 143);fill:none;}#chatgpt-mermaid-\_r_3jm\_ .edgeLabel{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3jm\_ .edgeLabel p{background-color:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3jm\_ .edgeLabel rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3jm\_ .labelBkg{background-color:rgba(252, 252, 252, 0.5);}#chatgpt-mermaid-\_r_3jm\_ .cluster rect{fill:rgb(243, 243, 243);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .cluster text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ .cluster span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:12px;background:rgb(243, 243, 243);border:1px solid rgba(0, 0, 0, 0.1);border-radius:2px;pointer-events:none;z-index:100;}#chatgpt-mermaid-\_r_3jm\_ .flowchartTitleText{text-anchor:middle;font-size:18px;fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3jm\_ rect.text{fill:none;stroke-width:0;}#chatgpt-mermaid-\_r_3jm\_ .icon-shape,#chatgpt-mermaid-\_r_3jm\_ .image-shape{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3jm\_ .icon-shape p,#chatgpt-mermaid-\_r_3jm\_ .image-shape p{background-color:rgb(252, 252, 252);padding:2px;}#chatgpt-mermaid-\_r_3jm\_ .icon-shape .label rect,#chatgpt-mermaid-\_r_3jm\_ .image-shape .label rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3jm\_ .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#chatgpt-mermaid-\_r_3jm\_ .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#chatgpt-mermaid-\_r_3jm\_ .node .neo-node{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node rect,#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].cluster rect,#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node polygon{stroke:url(#chatgpt-mermaid-\_r_3jm\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].swimlane.cluster rect{filter:none;}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node path{stroke:url(#chatgpt-mermaid-\_r_3jm\_-gradient);stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node .neo-line path{stroke:rgb(83, 154, 248);filter:none;}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node circle{stroke:url(#chatgpt-mermaid-\_r_3jm\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].node circle .state-start{fill:#000000;}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].icon-shape .icon{fill:url(#chatgpt-mermaid-\_r_3jm\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3jm\_ [data-look="neo"].icon-shape .icon-neo path{stroke:url(#chatgpt-mermaid-\_r_3jm\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3jm\_ .node text{font-size:14px;font-weight:600;letter-spacing:normal;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3jm\_ .edgeLabels text{font-size:13px;font-weight:600;letter-spacing:-0.08px;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3jm\_ .node tspan[font-weight="normal"],#chatgpt-mermaid-\_r_3jm\_ .edgeLabels tspan[font-weight="normal"]{font-weight:600;}#chatgpt-mermaid-\_r_3jm\_ .edgeLabel .label rect{opacity:1;rx:13px;ry:13px;fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .node rect,#chatgpt-mermaid-\_r_3jm\_ .node circle,#chatgpt-mermaid-\_r_3jm\_ .node ellipse,#chatgpt-mermaid-\_r_3jm\_ .node polygon,#chatgpt-mermaid-\_r_3jm\_ .node path{fill:rgb(229, 243, 255);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3jm\_ .node rect{rx:16px;ry:16px;}#chatgpt-mermaid-\_r_3jm\_ .mermaid-decision .label-container{fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-dasharray:2,2;}#chatgpt-mermaid-\_r_3jm\_ .edgePaths .flowchart-link{stroke:rgb(143, 143, 143);stroke-width:1px;stroke-linecap:round;stroke-linejoin:round;}#chatgpt-mermaid-\_r_3jm\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3jm\_ :root{--mermaid-font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";}Domestic Region BDomestic Region AOpenShift Cluster BKafka Cluster BFinancial State Store BHSM Integration BIBM MQ Connectivity BOpenShift Cluster AKafka Cluster AFinancial State Store AHSM Integration AIBM MQ Connectivity APayment ConsumersDomestic Traffic ManagementIBM z/OS Core Banking This is a conceptual topology, not a claim that Kafka, database or HSM replication is already configured for zero data loss. ### Critical active-active design decision Do not assume that simply running two OpenShift clusters makes the financial platform active-active. Recommended model: - Both regions can accept traffic. - Payment processing is distributed by account ownership or account partition. - Financial writes for a particular account are serialized. - A consensus or equivalent fencing mechanism prevents concurrent conflicting writes. - Region failover transfers ownership safely. - Financial state is synchronously durable within the agreed failure model. For critical financial state, asynchronous cross-region replication alone is insufficient to guarantee RPO 0. ### Region failure behavior | Failure | Expected behavior | | ---------------------------- | ----------------------------------------------- | | Application instance failure | Restart or route traffic to healthy instances | | OpenShift node failure | Reschedule workload | | Kafka broker failure | Continue using available replicas | | Fraud service failure | Apply explicit risk policy | | MQ connectivity failure | Persist pending postings and apply backpressure | | Core banking outage | Stop unsafe new financial commitments | | Regional failure | Fence failed ownership and fail over | | Network partition | Avoid split-brain financial writes | A crucial trade-off exists between availability and financial consistency during network partitions. The system must fail closed for operations where account ownership or balance correctness cannot be established. ## 6.8 Observability and operations Implement unified monitoring across payment orchestration, Kafka, MQ, CICS, fraud services, HSM and scheme adapters. ### Key metrics | Category | Metrics | | ------------------ | -------------------------------------------------------------- | | Payment processing | TPS, accepted, rejected, pending | | Latency | p50, p95, p99 and p99.9 | | Fraud | Scoring latency, timeout rate, approval/rejection distribution | | Sanctions | Screening latency, matches, unresolved cases | | Kafka | Consumer lag, replication status, broker health | | MQ | Queue depth, message age, processing rate | | Mainframe | CICS response time, transaction concurrency, queue backlog | | Financial control | Active holds, expired reservations, posting mismatches | | HSM | Signing throughput, latency, utilization | | Reconciliation | Matched, unmatched and unresolved transactions | | Availability | Dependency availability and payment journey success | ### Distributed tracing A payment should be traceable across: ``` API Gateway -> Payment Ingress -> Fraud Engine -> Sanctions Engine -> Financial Control -> Kafka -> IBM MQ -> CICS -> Payment Scheme -> Reconciliation ``` Use OpenTelemetry-compatible instrumentation. Ensure trace propagation across Kafka and MQ boundaries. Sensitive information must be excluded or masked from telemetry. ### Operational ownership A proposed support structure: | Support level | Responsibility | | ------------------- | -------------------------------------------------------------- | | L1 | Monitoring and incident intake | | L2 | Platform, application and integration troubleshooting | | L3 | Payment engineering, database, mainframe and fraud specialists | | Security operations | Security incidents and threat response | | Business operations | Payment exceptions and reconciliation | A 24/7 support model is necessary for a 24/7/365 payment platform, but actual staffing and escalation SLAs are not specified. ## 6.9 Scalability and performance ### Throughput architecture ## Target processing capacity Baseline throughput # 3,500 Transactions per second Peak throughput # 12,000 Transactions per second Peak is approximately 3.43 times baseline. These are business targets, not measured system capacity. ### Scaling strategy | Component | Scaling strategy | | --------------------- | --------------------------------------------------- | | API ingress | Horizontal scaling | | Payment orchestration | Horizontal scaling with account partition awareness | | Fraud inference | Independent horizontal scaling | | Sanctions engine | Independent capacity management | | Kafka | Partition and broker scaling | | Financial database | Partitioning and carefully controlled concurrency | | MQ | Queue and consumer capacity management | | Ledger workers | Controlled concurrency and backpressure | | Reconciliation | Independent batch/stream processing | ### Mainframe protection The mainframe must not receive 12,000 TPS directly. The proposed approach: 1. Persist incoming payment state independently. 2. Apply account and financial controls. 3. Publish ledger posting instructions. 4. Process through controlled ledger integration workers. 5. Respect the actual CICS capacity envelope. 6. Monitor queue depth and message age. 7. Apply admission control when downstream capacity is exhausted. The 800 concurrent TPS limit must not be confused with a guaranteed sustained 800 TPS throughput. Mainframe transaction duration, workload mix, MQ throughput and CICS capacity testing are necessary to determine the true safe posting rate. ### Illustrative capacity relationship If the mainframe can sustain \\(L\\) postings per second, and incoming payment processing generates \\(P\\) postings per second: \\[ BacklogGrowth = P-L \\] If: \\[ P>L \\] the backlog grows until processing catches up or storage limits are reached. Consequently, asynchronous integration protects the mainframe but does not eliminate its capacity constraint. The bank must establish: - Maximum permitted backlog. - Maximum acceptable posting delay. - Maximum exposure of accepted but unposted payments. - Admission control thresholds. - Recovery drain capacity. ### Fraud latency budget The 80 ms fraud allocation should be treated as a hard service-level budget, not simply a model inference target. Proposed initial budget for engineering validation: | Activity | Proposed budget | | -------------------- | --------------- | | Feature retrieval | 15 ms | | Model inference | 30 ms | | Risk rule evaluation | 15 ms | | Decision aggregation | 10 ms | | Internal overhead | 10 ms | | Total | 80 ms | These are proposed allocations, not measured performance figures. Fraud and sanctions screening should execute in parallel where business dependencies permit. The total payment latency will be constrained by the slower required screening path. ### End-to-end latency budget An initial proposed budget for the 400 ms API target: | Activity | Proposed budget | | --------------------------------------- | --------------- | | API ingress and authentication | 25 ms | | Message validation and normalization | 35 ms | | Parallel fraud evaluation | 80 ms | | Sanctions evaluation | 100 ms | | Financial control and persistence | 65 ms | | Orchestration and response construction | 45 ms | | Network and integration allowance | 50 ms | | Total | 400 ms | The sanctions allocation is an engineering proposal and must be validated against actual provider performance. There is also an important API contract decision: whether the 400 ms target covers acceptance into durable processing or completion of the external payment and core-ledger posting. A synchronous API cannot guarantee sub-400 ms final settlement if downstream scheme or mainframe processing takes longer. A durable acceptance response with an explicit pending status may be required. ## 6.10 DevOps and CI/CD Recommended delivery architecture: | Area | Recommendation | | ---------------------- | ------------------------------------------------ | | Source control | Enterprise Git platform | | Build | Automated Java builds | | Containerization | OCI-compatible images | | Image security | Vulnerability and image provenance scanning | | Deployment | OpenShift-native deployment pipelines | | Infrastructure as Code | Terraform or existing enterprise standard | | Configuration | Environment-specific external configuration | | Secrets | Enterprise secrets management | | Testing | Automated unit, integration and contract tests | | Deployment | Canary or controlled progressive rollout | | Rollback | Versioned application and configuration rollback | | Database migration | Versioned, backward-compatible migrations | ### Release strategy Use expand-and-contract database migrations. Avoid deploying application versions that require an immediate incompatible schema change. For critical payment services: - Release changes progressively. - Preserve compatibility with previously deployed consumers. - Avoid replaying financial side effects during rollback. - Keep event schemas versioned. - Require explicit production release authorization. ## 6.11 Cost breakdown and optimization Cost estimate not possible with current information. The following cost categories must be evaluated. | Cost category | Main cost drivers | | -------------- | --------------------------------------------------- | | OpenShift | Nodes, subscriptions and support | | Azure | Compute, storage and managed services | | Kafka | Brokers, storage, replication and support | | Database | Licensing, replication, compute and storage | | IBM mainframe | MIPS consumption and CICS workload | | IBM MQ | Licensing and infrastructure | | HSM | Hardware, support, capacity and redundancy | | Oracle Exadata | Licensing and infrastructure | | Network | Dedicated connectivity and cross-region replication | | Observability | Metrics, logs, traces and retention | | Security | IAM, secrets, scanning and monitoring | | Operations | 24/7 support and specialist staffing | ### Cost optimization recommendations 1. Reuse existing enterprise platforms. 2. Avoid unnecessary microservice proliferation. 3. Keep Exadata focused on reporting rather than operational payment writes. 4. Optimize mainframe calls to reduce MIPS consumption. 5. Apply appropriate Kafka retention and tiering. 6. Use workload-specific autoscaling. 7. Avoid unnecessarily duplicating large historical datasets. 8. Monitor cross-region replication costs. 9. Measure fraud inference cost per transaction. ## 6.12 Architecture rationale The recommended architecture is justified by five major requirements. 1\. High throughput: Kafka and horizontal application scaling absorb payment traffic without requiring every request to synchronously reach the mainframe. 2\. Financial integrity: Strongly consistent transaction storage, idempotency and controlled posting reduce duplicate financial side effects. 3\. Fraud protection: Inline parallel evaluation enables risk decisions before payment authorization. 4\. Mainframe protection: Controlled ledger integration shields IBM z/OS from external transaction spikes. 5\. Delivery feasibility: Reusing OpenShift, Kafka, MQ, CICS, HSM and Exadata reduces unnecessary technology introduction. ## 6.13 Architecture trade-offs | Optimized for | Accepted limitation | | -------------------------- | ------------------------------------------------------------------------- | | Financial integrity | Some operations may fail closed during uncertain states | | Mainframe protection | Ledger synchronization may be asynchronous | | Horizontal scaling | Requires account-level consistency management | | Active-active availability | Requires cross-region consistency coordination | | Fast payment decisions | Fraud and sanctions dependencies need strict latency controls | | Delivery speed | Some domain boundaries may remain within modular applications | | Operational simplicity | The architecture still requires specialized distributed systems expertise | Architectural evolution trigger: Move additional modules into independent microservices only when separate deployment, scaling, ownership or fault isolation provides measurable operational value. # 7. Architecture Diagrams ## 7.1 System context diagram \#chatgpt-mermaid-\_r_3k4\_{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;fill:rgb(13, 13, 13);}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#chatgpt-mermaid-\_r_3k4\_ .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3k4\_ .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3k4\_ .error-icon{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3k4\_ .error-text{fill:rgb(13, 13, 13);stroke:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ .edge-thickness-normal{stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .edge-thickness-thick{stroke-width:3.5px;}#chatgpt-mermaid-\_r_3k4\_ .edge-pattern-solid{stroke-dasharray:0;}#chatgpt-mermaid-\_r_3k4\_ .edge-thickness-invisible{stroke-width:0;fill:none;}#chatgpt-mermaid-\_r_3k4\_ .edge-pattern-dashed{stroke-dasharray:3;}#chatgpt-mermaid-\_r_3k4\_ .edge-pattern-dotted{stroke-dasharray:2;}#chatgpt-mermaid-\_r_3k4\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3k4\_ .marker.cross{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3k4\_ svg{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;}#chatgpt-mermaid-\_r_3k4\_ p{margin:0;}#chatgpt-mermaid-\_r_3k4\_ .label{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ .cluster-label text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ .cluster-label span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ .cluster-label span p{background-color:transparent;}#chatgpt-mermaid-\_r_3k4\_ .label text,#chatgpt-mermaid-\_r_3k4\_ span{fill:rgb(13, 13, 13);color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ .node rect,#chatgpt-mermaid-\_r_3k4\_ .node circle,#chatgpt-mermaid-\_r_3k4\_ .node ellipse,#chatgpt-mermaid-\_r_3k4\_ .node polygon,#chatgpt-mermaid-\_r_3k4\_ .node path{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .rough-node .label text,#chatgpt-mermaid-\_r_3k4\_ .node .label text,#chatgpt-mermaid-\_r_3k4\_ .image-shape .label,#chatgpt-mermaid-\_r_3k4\_ .icon-shape .label{text-anchor:middle;}#chatgpt-mermaid-\_r_3k4\_ .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .rough-node .label,#chatgpt-mermaid-\_r_3k4\_ .node .label,#chatgpt-mermaid-\_r_3k4\_ .image-shape .label,#chatgpt-mermaid-\_r_3k4\_ .icon-shape .label{text-align:center;}#chatgpt-mermaid-\_r_3k4\_ .node.clickable{cursor:pointer;}#chatgpt-mermaid-\_r_3k4\_ .root .anchor path{fill:rgb(143, 143, 143)!important;stroke-width:0;stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3k4\_ .arrowheadPath{fill:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3k4\_ .edgePath .path{stroke:rgb(143, 143, 143);stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .flowchart-link{stroke:rgb(143, 143, 143);fill:none;}#chatgpt-mermaid-\_r_3k4\_ .edgeLabel{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3k4\_ .edgeLabel p{background-color:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3k4\_ .edgeLabel rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3k4\_ .labelBkg{background-color:rgba(252, 252, 252, 0.5);}#chatgpt-mermaid-\_r_3k4\_ .cluster rect{fill:rgb(243, 243, 243);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .cluster text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ .cluster span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:12px;background:rgb(243, 243, 243);border:1px solid rgba(0, 0, 0, 0.1);border-radius:2px;pointer-events:none;z-index:100;}#chatgpt-mermaid-\_r_3k4\_ .flowchartTitleText{text-anchor:middle;font-size:18px;fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3k4\_ rect.text{fill:none;stroke-width:0;}#chatgpt-mermaid-\_r_3k4\_ .icon-shape,#chatgpt-mermaid-\_r_3k4\_ .image-shape{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3k4\_ .icon-shape p,#chatgpt-mermaid-\_r_3k4\_ .image-shape p{background-color:rgb(252, 252, 252);padding:2px;}#chatgpt-mermaid-\_r_3k4\_ .icon-shape .label rect,#chatgpt-mermaid-\_r_3k4\_ .image-shape .label rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3k4\_ .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#chatgpt-mermaid-\_r_3k4\_ .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#chatgpt-mermaid-\_r_3k4\_ .node .neo-node{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node rect,#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].cluster rect,#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node polygon{stroke:url(#chatgpt-mermaid-\_r_3k4\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].swimlane.cluster rect{filter:none;}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node path{stroke:url(#chatgpt-mermaid-\_r_3k4\_-gradient);stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node .neo-line path{stroke:rgb(83, 154, 248);filter:none;}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node circle{stroke:url(#chatgpt-mermaid-\_r_3k4\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].node circle .state-start{fill:#000000;}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].icon-shape .icon{fill:url(#chatgpt-mermaid-\_r_3k4\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3k4\_ [data-look="neo"].icon-shape .icon-neo path{stroke:url(#chatgpt-mermaid-\_r_3k4\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3k4\_ .node text{font-size:14px;font-weight:600;letter-spacing:normal;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3k4\_ .edgeLabels text{font-size:13px;font-weight:600;letter-spacing:-0.08px;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3k4\_ .node tspan[font-weight="normal"],#chatgpt-mermaid-\_r_3k4\_ .edgeLabels tspan[font-weight="normal"]{font-weight:600;}#chatgpt-mermaid-\_r_3k4\_ .edgeLabel .label rect{opacity:1;rx:13px;ry:13px;fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .node rect,#chatgpt-mermaid-\_r_3k4\_ .node circle,#chatgpt-mermaid-\_r_3k4\_ .node ellipse,#chatgpt-mermaid-\_r_3k4\_ .node polygon,#chatgpt-mermaid-\_r_3k4\_ .node path{fill:rgb(229, 243, 255);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3k4\_ .node rect{rx:16px;ry:16px;}#chatgpt-mermaid-\_r_3k4\_ .mermaid-decision .label-container{fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-dasharray:2,2;}#chatgpt-mermaid-\_r_3k4\_ .edgePaths .flowchart-link{stroke:rgb(143, 143, 143);stroke-width:1px;stroke-linecap:round;stroke-linejoin:round;}#chatgpt-mermaid-\_r_3k4\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3k4\_ :root{--mermaid-font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";}Bank Payment Modernization PlatformPayment API LayerPayment OrchestrationFraud and SanctionsFinancial ControlCore IntegrationReconciliationRetail BankingCorporate BankingExternal Payment ParticipantsIBM z/OS Core BankingIBM MQOn-Prem HSMEnterprise KafkaDomestic and InternationalSchemesOracle Exadata ## 7.2 Payment transaction flow CICS/CoreIBM MQKafkaPayment StoreFinancial ControlRisk EngineOrchestratorPayment APIChannelCICS/CoreIBM MQKafkaPayment StoreFinancial ControlRisk EngineOrchestratorPayment APIChannel#chatgpt-mermaid-\_r_3kb\_{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;fill:rgb(13, 13, 13);}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#chatgpt-mermaid-\_r_3kb\_ .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3kb\_ .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3kb\_ .error-icon{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3kb\_ .error-text{fill:rgb(13, 13, 13);stroke:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3kb\_ .edge-thickness-normal{stroke-width:1px;}#chatgpt-mermaid-\_r_3kb\_ .edge-thickness-thick{stroke-width:3.5px;}#chatgpt-mermaid-\_r_3kb\_ .edge-pattern-solid{stroke-dasharray:0;}#chatgpt-mermaid-\_r_3kb\_ .edge-thickness-invisible{stroke-width:0;fill:none;}#chatgpt-mermaid-\_r_3kb\_ .edge-pattern-dashed{stroke-dasharray:3;}#chatgpt-mermaid-\_r_3kb\_ .edge-pattern-dotted{stroke-dasharray:2;}#chatgpt-mermaid-\_r_3kb\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ .marker.cross{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ svg{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;}#chatgpt-mermaid-\_r_3kb\_ p{margin:0;}#chatgpt-mermaid-\_r_3kb\_ .actor{stroke:rgb(83, 154, 248);fill:rgb(222, 234, 251);stroke-width:1;}#chatgpt-mermaid-\_r_3kb\_ rect.actor.outer-path[data-look="neo"]{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ rect.note[data-look="neo"]{stroke:rgb(107, 198, 127);fill:rgb(243, 243, 243);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ text.actor>tspan{fill:rgb(13, 13, 13);stroke:none;}#chatgpt-mermaid-\_r_3kb\_ .actor-line{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ .innerArc{stroke-width:1.5;stroke-dasharray:none;}#chatgpt-mermaid-\_r_3kb\_ .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ [id$="-arrowhead"] path{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ .sequenceNumber{fill:#707070;}#chatgpt-mermaid-\_r_3kb\_ [id$="-sequencenumber"]{fill:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ [id$="-crosshead"] path{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3kb\_ .messageText{fill:rgb(13, 13, 13);stroke:none;}#chatgpt-mermaid-\_r_3kb\_ .labelBox{stroke:rgba(0, 0, 0, 0.1);fill:rgb(252, 252, 252);filter:none;}#chatgpt-mermaid-\_r_3kb\_ .labelText,#chatgpt-mermaid-\_r_3kb\_ .labelText>tspan{fill:rgb(13, 13, 13);stroke:none;}#chatgpt-mermaid-\_r_3kb\_ .loopText,#chatgpt-mermaid-\_r_3kb\_ .loopText>tspan{fill:rgb(13, 13, 13);stroke:none;}#chatgpt-mermaid-\_r_3kb\_ .sectionTitle,#chatgpt-mermaid-\_r_3kb\_ .sectionTitle>tspan{fill:rgb(13, 13, 13);stroke:none;}#chatgpt-mermaid-\_r_3kb\_ .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:rgba(0, 0, 0, 0.1);fill:rgba(0, 0, 0, 0.1);}#chatgpt-mermaid-\_r_3kb\_ .note{stroke:rgb(107, 198, 127);fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3kb\_ .noteText,#chatgpt-mermaid-\_r_3kb\_ .noteText>tspan{fill:rgb(13, 13, 13);stroke:none;font-weight:normal;}#chatgpt-mermaid-\_r_3kb\_ .activation0{fill:rgb(243, 243, 243);stroke:hsl(0, 0%, 85.2941176471%);}#chatgpt-mermaid-\_r_3kb\_ .activation1{fill:rgb(243, 243, 243);stroke:hsl(0, 0%, 85.2941176471%);}#chatgpt-mermaid-\_r_3kb\_ .activation2{fill:rgb(243, 243, 243);stroke:hsl(0, 0%, 85.2941176471%);}#chatgpt-mermaid-\_r_3kb\_ .actorPopupMenu{position:absolute;}#chatgpt-mermaid-\_r_3kb\_ .actorPopupMenuPanel{position:absolute;fill:rgb(222, 234, 251);box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#chatgpt-mermaid-\_r_3kb\_ .actor-man circle,#chatgpt-mermaid-\_r_3kb\_ line{fill:rgb(222, 234, 251);stroke-width:2px;}#chatgpt-mermaid-\_r_3kb\_ g rect.rect{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3kb\_ .node .neo-node{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node rect,#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].cluster rect,#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node polygon{stroke:url(#chatgpt-mermaid-\_r_3kb\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].swimlane.cluster rect{filter:none;}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node path{stroke:url(#chatgpt-mermaid-\_r_3kb\_-gradient);stroke-width:1px;}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node .neo-line path{stroke:rgb(83, 154, 248);filter:none;}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node circle{stroke:url(#chatgpt-mermaid-\_r_3kb\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].node circle .state-start{fill:#000000;}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].icon-shape .icon{fill:url(#chatgpt-mermaid-\_r_3kb\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ [data-look="neo"].icon-shape .icon-neo path{stroke:url(#chatgpt-mermaid-\_r_3kb\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3kb\_ :root{--mermaid-font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";}Submit paymentAuthenticate and validateCreate paymentFraud + sanctions screeningRisk decisionsRequest funds reservationPersist payment + reservation + outboxCommitReservation confirmedPublish payment eventLedger posting instructionCICS posting requestPosting resultPosting confirmation eventUpdate payment stateReturn payment statusPayment response The diagram illustrates the internal workflow. External scheme submission, settlement and compensation must be ordered according to each rail's contractual processing rules. ## 7.3 Deployment architecture \#chatgpt-mermaid-\_r_3ki\_{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;fill:rgb(13, 13, 13);}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#chatgpt-mermaid-\_r_3ki\_ .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3ki\_ .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#chatgpt-mermaid-\_r_3ki\_ .error-icon{fill:rgb(243, 243, 243);}#chatgpt-mermaid-\_r_3ki\_ .error-text{fill:rgb(13, 13, 13);stroke:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ .edge-thickness-normal{stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .edge-thickness-thick{stroke-width:3.5px;}#chatgpt-mermaid-\_r_3ki\_ .edge-pattern-solid{stroke-dasharray:0;}#chatgpt-mermaid-\_r_3ki\_ .edge-thickness-invisible{stroke-width:0;fill:none;}#chatgpt-mermaid-\_r_3ki\_ .edge-pattern-dashed{stroke-dasharray:3;}#chatgpt-mermaid-\_r_3ki\_ .edge-pattern-dotted{stroke-dasharray:2;}#chatgpt-mermaid-\_r_3ki\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3ki\_ .marker.cross{stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3ki\_ svg{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:16px;}#chatgpt-mermaid-\_r_3ki\_ p{margin:0;}#chatgpt-mermaid-\_r_3ki\_ .label{font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ .cluster-label text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ .cluster-label span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ .cluster-label span p{background-color:transparent;}#chatgpt-mermaid-\_r_3ki\_ .label text,#chatgpt-mermaid-\_r_3ki\_ span{fill:rgb(13, 13, 13);color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ .node rect,#chatgpt-mermaid-\_r_3ki\_ .node circle,#chatgpt-mermaid-\_r_3ki\_ .node ellipse,#chatgpt-mermaid-\_r_3ki\_ .node polygon,#chatgpt-mermaid-\_r_3ki\_ .node path{fill:rgb(222, 234, 251);stroke:rgb(83, 154, 248);stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .rough-node .label text,#chatgpt-mermaid-\_r_3ki\_ .node .label text,#chatgpt-mermaid-\_r_3ki\_ .image-shape .label,#chatgpt-mermaid-\_r_3ki\_ .icon-shape .label{text-anchor:middle;}#chatgpt-mermaid-\_r_3ki\_ .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .rough-node .label,#chatgpt-mermaid-\_r_3ki\_ .node .label,#chatgpt-mermaid-\_r_3ki\_ .image-shape .label,#chatgpt-mermaid-\_r_3ki\_ .icon-shape .label{text-align:center;}#chatgpt-mermaid-\_r_3ki\_ .node.clickable{cursor:pointer;}#chatgpt-mermaid-\_r_3ki\_ .root .anchor path{fill:rgb(143, 143, 143)!important;stroke-width:0;stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3ki\_ .arrowheadPath{fill:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3ki\_ .edgePath .path{stroke:rgb(143, 143, 143);stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .flowchart-link{stroke:rgb(143, 143, 143);fill:none;}#chatgpt-mermaid-\_r_3ki\_ .edgeLabel{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3ki\_ .edgeLabel p{background-color:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3ki\_ .edgeLabel rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3ki\_ .labelBkg{background-color:rgba(252, 252, 252, 0.5);}#chatgpt-mermaid-\_r_3ki\_ .cluster rect{fill:rgb(243, 243, 243);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .cluster text{fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ .cluster span{color:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";font-size:12px;background:rgb(243, 243, 243);border:1px solid rgba(0, 0, 0, 0.1);border-radius:2px;pointer-events:none;z-index:100;}#chatgpt-mermaid-\_r_3ki\_ .flowchartTitleText{text-anchor:middle;font-size:18px;fill:rgb(13, 13, 13);}#chatgpt-mermaid-\_r_3ki\_ rect.text{fill:none;stroke-width:0;}#chatgpt-mermaid-\_r_3ki\_ .icon-shape,#chatgpt-mermaid-\_r_3ki\_ .image-shape{background-color:rgb(252, 252, 252);text-align:center;}#chatgpt-mermaid-\_r_3ki\_ .icon-shape p,#chatgpt-mermaid-\_r_3ki\_ .image-shape p{background-color:rgb(252, 252, 252);padding:2px;}#chatgpt-mermaid-\_r_3ki\_ .icon-shape .label rect,#chatgpt-mermaid-\_r_3ki\_ .image-shape .label rect{opacity:0.5;background-color:rgb(252, 252, 252);fill:rgb(252, 252, 252);}#chatgpt-mermaid-\_r_3ki\_ .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#chatgpt-mermaid-\_r_3ki\_ .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#chatgpt-mermaid-\_r_3ki\_ .node .neo-node{stroke:rgb(83, 154, 248);}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node rect,#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].cluster rect,#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node polygon{stroke:url(#chatgpt-mermaid-\_r_3ki\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].swimlane.cluster rect{filter:none;}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node path{stroke:url(#chatgpt-mermaid-\_r_3ki\_-gradient);stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node .outer-path{filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node .neo-line path{stroke:rgb(83, 154, 248);filter:none;}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node circle{stroke:url(#chatgpt-mermaid-\_r_3ki\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].node circle .state-start{fill:#000000;}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].icon-shape .icon{fill:url(#chatgpt-mermaid-\_r_3ki\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3ki\_ [data-look="neo"].icon-shape .icon-neo path{stroke:url(#chatgpt-mermaid-\_r_3ki\_-gradient);filter:drop-shadow( 1px 2px 2px rgba(185,185,185,1));}#chatgpt-mermaid-\_r_3ki\_ .node text{font-size:14px;font-weight:600;letter-spacing:normal;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3ki\_ .edgeLabels text{font-size:13px;font-weight:600;letter-spacing:-0.08px;fill:rgb(0, 79, 153);}#chatgpt-mermaid-\_r_3ki\_ .node tspan[font-weight="normal"],#chatgpt-mermaid-\_r_3ki\_ .edgeLabels tspan[font-weight="normal"]{font-weight:600;}#chatgpt-mermaid-\_r_3ki\_ .edgeLabel .label rect{opacity:1;rx:13px;ry:13px;fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .node rect,#chatgpt-mermaid-\_r_3ki\_ .node circle,#chatgpt-mermaid-\_r_3ki\_ .node ellipse,#chatgpt-mermaid-\_r_3ki\_ .node polygon,#chatgpt-mermaid-\_r_3ki\_ .node path{fill:rgb(229, 243, 255);stroke:rgba(0, 0, 0, 0.1);stroke-width:1px;}#chatgpt-mermaid-\_r_3ki\_ .node rect{rx:16px;ry:16px;}#chatgpt-mermaid-\_r_3ki\_ .mermaid-decision .label-container{fill:rgb(245, 250, 255);stroke:rgb(206, 219, 229);stroke-dasharray:2,2;}#chatgpt-mermaid-\_r_3ki\_ .edgePaths .flowchart-link{stroke:rgb(143, 143, 143);stroke-width:1px;stroke-linecap:round;stroke-linejoin:round;}#chatgpt-mermaid-\_r_3ki\_ .marker{fill:rgb(143, 143, 143);stroke:rgb(143, 143, 143);}#chatgpt-mermaid-\_r_3ki\_ :root{--mermaid-font-family:-apple-system-body,ui-sans-serif,-apple-system,system-ui,"Segoe UI",Helvetica,"Apple Color Emoji",Arial,sans-serif,"Segoe UI Emoji","Segoe UI Symbol";}Region B - Domestic DR / ActiveRegion A - On PremisesOpenShift BKafka BFinancial Database BHSM BIBM MQ BOpenShift AKafka AFinancial Database AHSM AIBM MQ ABanking ChannelsDomestic Traffic ManagementApproved SynchronousReplication / ConsensusIBM z/OS MainframeAzure Landing Zone -Approved WorkloadsOracle Exadata Deployment qualification: The diagram does not imply that all components should be synchronously replicated. The consistency model must be defined separately for financial state, Kafka events, audit records and derived reporting data. # 8. Key Architecture Decisions The following are proposed architecture decision records. | Decision area | Recommendation | Rationale | Trade-off | | --------------------- | --------------------------------------- | ----------------------------------------- | ----------------------------------- | | Architecture pattern | Event-driven modular architecture | Supports decoupling and throughput | Distributed coordination | | Backend | Java + Spring Boot candidate | Enterprise integration ecosystem | JVM operational tuning | | Frontend | Reuse existing channels | Avoid unnecessary scope | Depends on existing API readiness | | Database | Strongly consistent relational database | Financial transaction guarantees | Replication and licensing cost | | Streaming | Existing Kafka | Reuses investment | Requires event governance | | Mainframe integration | IBM MQ + CICS | Mandatory integration boundary | Posting throughput constraint | | API strategy | REST plus ISO 20022 adapters | Channel and scheme interoperability | Multiple contracts | | Fraud | Inline parallel scoring | Pre-authorization risk evaluation | Dependency latency | | Sanctions | Inline mandatory screening | Regulatory risk control | External dependency availability | | Cryptography | On-prem HSM | Key custody requirement | Hardware capacity constraints | | Consistency | Account-level serialization | Prevents conflicting financial operations | Coordination overhead | | Transaction messaging | Outbox + idempotent consumers | Reliable event publication | Duplicate delivery remains possible | | Orchestration | Persisted Saga/state machine | Recovery and workflow visibility | More explicit state management | | Deployment | OpenShift hybrid | Reuses enterprise platform | Platform operations complexity | | Resilience | Active-active with fencing | Regional resilience | Consistency trade-offs | | Observability | OpenTelemetry-compatible platform | End-to-end visibility | Storage and operational overhead | | Reporting | Oracle Exadata | Existing regulatory investment | Not suitable as transactional store | | Audit | Immutable WORM storage | Tamper-resistant evidence | Retention and storage costs | ## 8.1 Most important ADR: Financial consistency Critical ADR — Must be approved Decision: Establish whether the payment control layer is permitted to own authoritative available-funds reservations. There are two viable models: | Model | Description | Consequence | | ----------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | Core-owned reservations | Mainframe controls holds and available balance | Stronger central financial authority, but core capacity and latency become critical | | Payment-platform-owned reservations | Platform maintains a strongly consistent account control and reservation ledger | Higher scalability, but introduces additional accounting governance and reconciliation responsibilities | My recommendation is to prefer platform-owned operational reservations only if the bank formally approves the financial control model, atomic account-level sequencing, exposure limits, recovery procedures and accounting reconciliation. Otherwise, retain core-owned reservation authority and reconsider the achievable throughput and latency requirements. This decision cannot be hidden inside implementation details. # 9. Risks and Mitigations | Risk | Impact | Likelihood | Mitigation | | --------------------------------- | -------------------------------- | -------------------- | --------------------------------------- | | Shadow balance inconsistency | Financial loss | High until validated | Formal financial control model | | Duplicate core postings | Financial loss | Medium | Unique posting reference and inquiry | | Kafka replication lag | Data recovery risk | Medium | Explicit durability and failover design | | Regional network partition | Conflicting writes | Medium | Fencing and fail-closed controls | | Fraud false negatives | Fraud losses | Medium | Model validation and rule controls | | Fraud false positives | Customer impact | Medium | Decision governance and review | | Sanctions service outage | Compliance exposure | Medium | Fail-closed policy and escalation | | Mainframe queue accumulation | Posting delays | High | Admission control and backpressure | | HSM throughput saturation | Signing delays | Medium | Benchmark and redundant capacity | | Reconciliation failures | Unresolved financial differences | Medium | Independent reconciliation | | Scope expansion | Missed launch | High | Nine-month MVP scope control | | Regulatory interpretation changes | Compliance delays | Medium | Early regulatory engagement | | Vendor or product dependency | Service disruption | Medium | Dependency inventory and exit planning | | Operational skill shortage | Incident recovery delays | Medium | Training and operational readiness | ## 9.1 Particularly important failure scenarios Scenario A: Payment posted but acknowledgement lost - Do not submit a new debit blindly. - Preserve the original posting reference. - Query the transaction outcome through an approved CICS inquiry mechanism. - Resolve the payment to posted, not posted, or unresolved. - Retry only when non-posting is established or downstream idempotency guarantees safe repetition. Scenario B: Kafka event published but outbox status not updated - Publisher may publish the same event again. - Consumer must deduplicate using event ID and business transaction reference. - Financial side effects must remain idempotent. Scenario C: Region A loses connectivity to Region B - Detect the partition. - Prevent conflicting account ownership. - Fence the previous writer. - Transfer account partition ownership only after consistency is established. - Fail closed where consistency cannot be proven. Scenario D: Fraud engine becomes unavailable - Apply a bank-approved risk policy. - High-risk or mandatory-screening transactions must not bypass screening. - Lower-risk fallback, if permitted, requires explicit transaction limits and documented regulatory approval. Scenario E: Mainframe processing falls behind - Continue only within approved financial exposure limits. - Stop or defer new transactions when available-funds correctness cannot be maintained. - Prioritize pending postings. - Alert operations before backlog reaches the defined critical threshold. # 10. Implementation Roadmap ## 10.1 Nine-month delivery strategy The nine-month regulatory launch deadline changes the implementation strategy. I recommend delivering a controlled MVP first, followed by progressive capability expansion and operational hardening. The following schedule is a proposed planning baseline, not a validated delivery commitment. It assumes infrastructure, mainframe access, scheme specifications, security approvals and engineering resources can be made available early. ## Proposed nine-month delivery plan 1. Phase 1 — Architecture and MVP foundation Months 1–2 Payment ingestion, transaction state, idempotency, infrastructure and core integration proof of concept. 2. Phase 2 — Core payment and risk integration Months 3–4 Fraud, sanctions, financial controls, IBM MQ/CICS and first payment scheme. 3. Phase 3 — Financial integrity and resilience Months 5–6 Reconciliation, audit, regional failover, recovery and security validation. 4. Phase 4 — Performance and regulatory readiness Months 7–8 Peak load testing, operational readiness, compliance evidence and production certification. 5. Phase 5 — Controlled production launch Month 9 Production cutover, limited rollout, monitoring and stabilization. ## 10.2 Detailed implementation phases | Phase | Focus | Key activities | Deliverables | Dependencies | Exit criteria | | ----- | -------------------------- | ----------------------------------------------------------------------- | ------------------------------- | ---------------------------------------------- | --------------------------------------------------- | | 1 | MVP foundation | Architecture, OpenShift, database, Kafka, API, ISO parsing, idempotency | Deployable payment foundation | Infrastructure, architecture approvals | Durable payment acceptance and duplicate protection | | 2 | Payment and risk | Orchestration, fraud, sanctions, MQ/CICS, HSM, scheme adapters | End-to-end payment workflow | Scheme access, risk APIs, mainframe interfaces | Successful controlled payment execution | | 3 | Financial integrity | Reservations, recovery, audit, reconciliation, active-active | Financially controlled platform | Approved financial ownership and DR design | Demonstrated financial consistency and recovery | | 4 | Performance and compliance | Load tests, penetration tests, chaos tests, failover, audit evidence | Production readiness package | Stable integrated platform | All mandatory quality gates passed | | 5 | Production launch | Cutover, traffic ramp-up, hypercare, operational handover | Production payment hub | Regulatory and business approval | Controlled production operation | ### Phase 1: MVP Foundation The MVP should prove the essential transaction journey, not attempt to implement every payment rail. Deliver: - Payment API. - ISO 20022 parsing and validation. - Payment state machine. - Durable transaction database. - Idempotency. - Kafka integration. - Outbox publisher. - IBM MQ/CICS connectivity proof of concept. - Basic operational dashboards. MVP success criterion: A payment can be received, validated, persisted, tracked and recovered without creating duplicate processing. ### Phase 2: Core payment capabilities Deliver: - Inline fraud scoring. - Sanctions integration. - HSM signing integration. - Account reservation mechanism. - Core posting workflow. - First domestic payment scheme. - Payment status responses. - Retry and exception handling. Success criterion: An end-to-end controlled payment journey works with actual downstream integrations. ### Phase 3: Financial integrity and resilience Deliver: - Account-level consistency. - Financial posting inquiry. - Reconciliation. - Immutable audit. - Regional replication. - Failover orchestration. - Disaster recovery testing. - Mainframe backpressure controls. Success criterion: The bank can demonstrate that payment outcomes remain consistent during duplicate delivery, uncertain posting outcomes and regional failures. ### Phase 4: Performance and regulatory readiness Execute: - 12,000 TPS peak performance testing. - 3,500 TPS baseline sustained testing. - p99 latency validation. - Fraud scoring latency validation. - HSM saturation testing. - Mainframe capacity testing. - MQ backlog recovery testing. - Security assessment. - PCI-DSS evidence collection. - DR and failover exercises. - Reconciliation completeness testing. Success criterion: All mandatory production acceptance criteria are demonstrated under representative conditions. ### Phase 5: Production launch Recommended rollout: 1. Internal controlled transactions. 2. Limited eligible customer transactions. 3. Controlled transaction volume expansion. 4. Broader retail rollout. 5. Corporate banking expansion. 6. Additional payment schemes. Use explicit rollback and traffic suspension criteria. Financial postings must never be rolled back merely because an application release is reverted. ## 10.3 Critical delivery dependencies The following must begin during the first month, rather than waiting for development completion: | Dependency | Required action | | ------------------- | -------------------------------------------------------- | | Mainframe team | Confirm CICS transaction contracts and capacity | | Payment operations | Define transaction and exception workflows | | Risk team | Provide model and screening integration contracts | | Security team | Approve HSM, key custody and trust boundaries | | Infrastructure team | Confirm domestic region topology | | Database team | Validate synchronous replication options | | Payment scheme team | Obtain technical specifications and certification access | | Compliance team | Define applicable regulatory acceptance criteria | Delivery warning: The financial reservation design and cross-region consistency proof of concept are potential critical-path items. If they are not resolved by the end of the first phase, the nine-month launch becomes materially more difficult. # 11. Technical Backlog and Engineering Acceptance Criteria The following is an implementation-oriented engineering backlog. | Workstream | Engineering activities | Priority | Dependencies | Acceptance criteria | | -------------- | --------------------------------------------------- | -------- | ---------------------------- | ------------------------------------------------------------- | | API | Payment initiation and status APIs | Critical | API contracts | Contract and security tests pass | | ISO 20022 | pacs.008, pacs.002, pain.001 parsing and validation | Critical | Scheme specifications | Valid and invalid message suites pass | | Backend | Payment lifecycle state machine | Critical | Domain model | All defined transitions tested | | Backend | Idempotency management | Critical | Database | Concurrent duplicate requests produce one financial execution | | Database | Transactional payment persistence | Critical | DB selection | Crash/recovery tests preserve committed state | | Database | Balance reservations | Critical | Financial ownership decision | No conflicting reservations under concurrent requests | | Kafka | Outbox publisher | Critical | Kafka and DB | Committed outbox events are eventually published | | Kafka | Consumer deduplication | Critical | Event contracts | Duplicate events do not repeat financial side effects | | Mainframe | IBM MQ adapter | Critical | MQ access | Persistent message recovery validated | | Mainframe | CICS posting adapter | Critical | CICS contracts | Posting inquiry and uncertain outcomes resolved | | Risk | Fraud inference integration | Critical | ML engine | p99 meets approved 80 ms budget | | Risk | Sanctions integration | Critical | Screening engine | Mandatory screening and timeout policy validated | | Security | HSM integration | Critical | HSM access | Signing and failover tests pass | | Infrastructure | OpenShift deployment | High | Platform access | Automated deployment and recovery validated | | Resilience | Active-active consistency | Critical | DB and network | No conflicting account writes during failover tests | | Audit | WORM audit records | Critical | Storage | Tamper and retention controls validated | | Reconciliation | Core and network matching | Critical | Ledger and scheme feeds | All unmatched records identified and tracked | | DevOps | CI/CD | High | Git and registry | Automated build and release controls | | Observability | Metrics, logs and tracing | High | Monitoring platform | End-to-end payment traceability demonstrated | | Testing | Load and resilience suites | Critical | Stable environment | NFR acceptance suite passed | ## 11.1 Critical engineering acceptance criteria These should be treated as non-negotiable production controls. AC-01: Duplicate transaction protection Given the same payment request is submitted multiple times with the same idempotency key, the system must create only one logical payment and prevent repeated financial execution. AC-02: Concurrent reservation protection Given multiple concurrent payments against the same account, the platform must serialize or otherwise strongly coordinate available-funds decisions so that approved payments cannot collectively exceed the authorized balance or overdraft allowance. AC-03: Uncertain core posting Given a CICS request times out after submission, the system must resolve the original posting outcome before issuing a potentially duplicating posting request. AC-04: Outbox durability Given a payment database transaction commits, the corresponding event publication intent must survive an application crash. AC-05: Regional recovery Given a regional failure, the platform must prevent stale or conflicting financial writers and recover within the approved 60-second RTO, without losing acknowledged financial state under the agreed failure model. AC-06: Fraud screening Given a mandatory fraud evaluation is unavailable or exceeds its deadline, the payment must follow an explicitly approved risk policy rather than silently bypassing screening. AC-07: Auditability Given any payment identifier, authorized investigators must be able to reconstruct its lifecycle, risk decisions, reservation history, core posting references and reconciliation outcome. AC-08: Performance The production candidate must demonstrate: - 3,500 TPS sustained baseline. - 12,000 TPS peak. - p99 API latency below 400 ms for the agreed API completion definition. - Fraud scoring within the 80 ms budget. - No unbounded mainframe queue growth under the approved workload profile. # 12. Architecture Governance and Quality Gates Architecture governance must be embedded in delivery rather than introduced at the end of the project. ## 12.1 Proposed quality gates | Quality gate | Validation | Mandatory before production? | | --------------------- | ------------------------------------------ | ---------------------------- | | Architecture approval | Approved HLD and LLD | Yes | | Domain ownership | Payment and financial ownership documented | Yes | | API governance | Versioning and contract approval | Yes | | ISO 20022 validation | Schema and business-rule tests | Yes | | Security architecture | Threat model and security review | Yes | | PCI-DSS scope | Documented assessment and evidence | Yes | | Data governance | Classification and residency approval | Yes | | Financial integrity | Duplicate and reconciliation tests | Yes | | Performance | Baseline and peak load testing | Yes | | Resilience | Regional failover and chaos testing | Yes | | Audit | WORM and traceability validation | Yes | | Operational readiness | Runbooks and 24/7 escalation | Yes | | Backup and recovery | Restore and DR testing | Yes | | Deployment | Rollback and release validation | Yes | | Code quality | Automated quality and security checks | Yes | ## 12.2 Required testing strategy | Test category | Scope | | ---------------------- | ----------------------------------------------------- | | Unit testing | Business rules and transaction state | | Integration testing | Kafka, MQ, CICS, HSM and risk systems | | Contract testing | ISO 20022 and payment scheme interfaces | | Concurrency testing | Duplicate requests and account-level reservations | | Load testing | Baseline and peak TPS | | Soak testing | Sustained operation and resource leakage | | Chaos testing | Broker, network and application failures | | Failover testing | Active-active region recovery | | Security testing | Penetration, vulnerability and access-control testing | | Reconciliation testing | Missing, duplicate and mismatched financial records | | Recovery testing | Crash, restart, replay and uncertain posting | | Certification testing | Payment scheme and applicable regulatory requirements | ## 12.3 Production readiness checklist Production readiness tracker 0/16 completed Financial reservation ownership formally approved CICS posting and inquiry contracts validated Idempotency and duplicate protection verified Fraud and sanctions fallback policies approved HSM capacity and failover tested 12,000 TPS peak test passed p99 API latency target demonstrated 80 ms fraud scoring budget demonstrated Zero-RPO recovery model validated Under-60-second RTO demonstrated Domestic data residency approved WORM audit controls validated Reconciliation and exception management operational 24/7 support and escalation established Security and regulatory approvals completed Production rollback and traffic suspension rehearsed Reset checklist This is a planning checklist, not evidence that any control has already passed. # 13. Clarifying Questions The following questions are intended to finalize the architecture and identify potential blockers before detailed design and implementation estimates are approved. I have prioritized questions according to their impact on financial correctness, delivery feasibility and regulatory compliance. ## 13.1 Business questions B1. What is the primary launch scope? Is the nine-month launch expected to support all retail, corporate, domestic and cross-border payments, or only selected payment schemes initially? B2. What does payment completion mean? Does the business require: - API acceptance within 400 ms? - Payment authorization within 400 ms? - Core ledger posting within 400 ms? - Final payment scheme confirmation within 400 ms? These are materially different requirements. B3. What is the expected daily transaction volume and average payment value? This affects storage, reconciliation, financial exposure and capacity sizing. ## 13.2 Functional questions F1. Which payment schemes must be supported at launch? Please identify the exact domestic and international rails. F2. Are corporate payment workflows required? For example: - Bulk payments. - Maker-checker approvals. - Multi-level authorization. - Payment limits. - Scheduled payments. F3. What happens when a payment is accepted but downstream posting fails? Should it remain pending, be reversed, or be routed for manual intervention? ## 13.3 Technical questions Critical T1. What backend technology is currently standardized within the bank? Java/Spring Boot, .NET, or another enterprise technology? T2. Which relational database technologies are already licensed and supported? For example, Oracle, Db2, PostgreSQL or another enterprise database. T3. Is the existing Kafka infrastructure configured for cross-region replication, and what durability guarantees are currently available? T4. What are the existing OpenShift cluster versions, capacities and regional topology? ## 13.4 Data architecture questions Critical D1. Is IBM z/OS the authoritative source for available account balance? D2. Can CICS perform atomic balance reservation and release transactions? D3. Does the mainframe expose a unique posting reference and transaction inquiry API or CICS transaction? D4. Is the bank willing to establish a separately governed payment control ledger for account reservations and available-funds decisions? This is the most important data architecture question. ## 13.5 Integration questions I1. Are IBM MQ and CICS interfaces already available, or must new interfaces be developed? I2. Are payment scheme adapters provided by vendors or built internally? I3. Is the fraud engine an existing bank platform or a new ML deployment? I4. Is sanctions screening performed internally or through an external provider? I5. What are the required payment scheme timeout, acknowledgement, retry and duplicate detection contracts? ## 13.6 Security and compliance questions S1. Which jurisdiction and central bank regulatory framework govern the platform? India is a possible operating jurisdiction, but it has not been explicitly established as the regulatory jurisdiction of this project. S2. Are both active-active regions within the same domestic jurisdiction? S3. Which HSM model and cryptographic interface are currently deployed? S4. Is PCI-DSS scope limited to payment card data, or does the bank intend to apply broader controls to the entire platform? S5. What are the required payment audit retention periods and immutable storage standards? ## 13.7 Infrastructure questions INF1. Are both OpenShift regions active-active today, or does one region currently function as disaster recovery? INF2. What is the measured network round-trip latency between the two regions? INF3. Is synchronous database replication supported across the two locations? INF4. Can the HSM infrastructure be accessed independently from both regions without violating security requirements? ## 13.8 NFR questions N1. Is the 12,000 TPS peak sustained or burst-based? N2. What is the expected duration of peak traffic? N3. Does the 99.999% availability requirement cover the API endpoint, payment authorization, or complete payment lifecycle? N4. Is the zero-RPO requirement applicable to all payment state, financial reservations, audit records and Kafka events, or only committed financial state? N5. What is the maximum acceptable delay between payment authorization and core ledger posting? ## 13.9 Delivery and operations questions DEL1. How many engineering teams and developers are available? DEL2. Are dedicated mainframe, database, Kafka, security and ML engineering teams available? DEL3. Is the nine-month deadline a regulatory production launch or a limited production pilot? DEL4. Is a dedicated 24/7 payment operations and SRE function already established? # 14. Final Architecture Recommendation ## 14.1 Recommended target architecture # Event-driven real-time payment platform Recommended architecture Payment Channels and Scheme Integrations Retail · Corporate · Domestic · Cross-border API Gateway and Payment Ingress Authentication · Validation · ISO 20022 · Idempotency Payment Orchestration State machine · Routing · Saga · Transaction management Fraud and Sanctions Inline parallel screening Financial Control Reservations · Consistency Strongly Consistent Payment Store Transactional state · Outbox · Financial controls Apache Kafka Durable event distribution · Controlled consumers IBM MQ and CICS Integration Backpressure · Posting · Recovery · Acknowledgement IBM z/OS Core Banking Existing authoritative accounting ledger Cross-cutting capabilities HSM · Security · Observability · WORM audit Supporting capabilities Reconciliation · Oracle Exadata · DR ## 14.2 My top five architectural decisions In order of importance: 1. Financial consistency: Decide who owns available-funds reservations and how financial commitments remain consistent with the core ledger. 2. Active-active consistency: Establish the cross-region replication, consensus and fencing model required for zero RPO. 3. Mainframe integration: Validate CICS posting idempotency, transaction inquiry, safe retries and actual throughput. 4. Risk evaluation: Establish fraud and sanctions latency, availability and failure policies. 5. Delivery scope: Select the minimum payment schemes and workflows required for the nine-month production launch. ## 14.3 What I would avoid As the architect accountable for implementation, I would explicitly avoid: - Creating 15–20 microservices before domain boundaries are proven. - Introducing multiple databases without a clear ownership requirement. - Treating Kafka as a financial system of record. - Assuming Kafka exactly-once semantics guarantee exactly-once financial execution. - Using asynchronous balance replication as the basis for unrestricted payment authorization. - Allowing automatic retries of uncertain CICS postings. - Sending every incoming payment directly to the mainframe. - Making Azure a dependency for operations that must traverse on-premises HSM infrastructure without proving latency and availability. - Attempting all payment schemes simultaneously in the MVP. - Claiming five-nines availability without including external schemes, network, MQ, mainframe, HSM and risk dependencies in the availability model. # 15. Immediate Next Steps Before producing a final low-level design, I recommend a focused architecture discovery and technical validation exercise. The following five answers will have the greatest impact on the architecture. ## Architecture discovery — critical decisions Five questions to turn the preliminary architecture into a validated implementation design. You can leave answers unanswered where information is unavailable. 1\. Financial balance ownership Who owns available balance and payment reservations? IBM z/OS remains the sole authority New payment control ledger owns reservations Hybrid model with core confirmation Not decided 2\. Mainframe capabilities What can the existing CICS interface support? Balance inquiry and debit/credit posting Atomic balance hold, release and posting Posting only Capabilities not yet confirmed 3\. Backend technology What is the preferred enterprise backend stack? Java / Spring Boot .NET Existing bank standard Open to recommendation 4\. Initial payment scope What must be included in the nine-month launch? Domestic instant payments only Domestic + selected cross-border rails All domestic and cross-border schemes Limited production pilot 5\. Active-active infrastructure What is the current regional database architecture? Synchronous replication available Asynchronous replication only Independent databases per region Not yet determined Additional architectural constraints (optional) Submit architecture inputs  Final architectural position: The project is technically achievable as a phased modernization, but the financial consistency model, mainframe transaction semantics and zero-RPO regional architecture are the three decisions that must be proven before committing to the production design. The strongest implementation strategy is to reuse the bank's existing enterprise infrastructure, introduce a controlled payment orchestration layer, protect the mainframe through durable asynchronous integration, and make financial correctness the primary architectural constraint. I can also help establish a weekly review of payment-rail, banking security and regulatory changes relevant to this architecture. 🏦Weekly payment architecture and regulatory watchTap to set up