Building a payment network in four phases, without rewriting it each time

Payment companies change shape as they gain licences. They start by orchestrating somebody else’s rails, then take a corridor end to end, then hold their own authorisation.

The usual cost of each step is a rewrite, and the usual risk of each rewrite is that a regulated behaviour quietly changes along the way.

The assumption that becomes a rebuild

Early on, somebody writes code that assumes the platform does not hold customer funds. It is true, so it is not written down anywhere — it is simply what the code does.

Two years later the company is authorised to hold funds, and that assumption is distributed across hundreds of files as the absence of something. Now it is a rewrite, conducted under commercial pressure, in the part of the system where errors are least forgiving.

Posture as rows

A corridor here records, as data:

• which phase it is in,
• its regulatory mode — non-custodial, partner custody, own authorisation, network operator,
• the licence basis it runs under and who holds the funds,
• the rails it may use and the limits that apply,
• which settlement mechanisms are permitted on it.

Moving from one phase to the next changes rows. The code does not have an opinion about custody, because custody is a field.

Incomplete postures cannot go live

A corridor is refused the live state while its posture is incomplete, and the refusal names what is missing: no licence basis, no payout rail, no daily limit.

This is a small mechanism with a large consequence. The commonest regulatory failure in payments is not defiance; it is a corridor that went live while somebody was still chasing a document, and nobody noticed because nothing stopped it.

Settlement that cannot be counted twice

Counterparty positions net what a partner received for you against what it paid out for you.

Prefunding is deliberately excluded. Placing your own liquidity at a partner is a treasury movement, not a debt the partner owes you. Counting it in both places makes every position wrong — quietly, and in your favour, which is the worst direction for a mistake to run.

There is a test whose only job is to keep that true.

Mechanisms that stay off

A settlement mechanism that requires a decision — a sponsored participation, a settlement token — is off on every corridor until that decision is recorded, with the reason kept against it.

Not off by convention. Off by refusal.

Gates with evidence

A phase gate is met only against a measurement and the evidence behind it. Both are required; a gate cannot be marked met because somebody is confident.

Alongside sit the open questions, each recording what it blocks. A board deciding whether to fund the next phase can see what is genuinely answered and what is still a hope.

That is an uncomfortable document to maintain. It is a considerably more uncomfortable conversation to have without one.

What you can check

These are facts about the running platform, not adjectives. Each one is visible in the product, in the API reference or in the ledger.

• Phase, regulatory mode, licence basis, custody model, rails and limits are rows, not branches in code.
• A corridor is refused the live state until its posture is complete, and the refusal lists exactly what is missing.
• Counterparty positions net what a partner received against what it paid, and prefunding is deliberately excluded so no movement is counted twice.
• Settlement batches are proposed by one administrator and approved by another, and the rail is re-checked at the moment of instruction.
• Phase gates are met only against a measurement and the evidence behind it, and the open questions blocking a phase are recorded with what each one blocks.

What it costs

Not a customer-facing product. It is the machinery a corridor runs on, and the discipline a board uses to decide whether the next phase is funded.

Is it switched on?

Whether this is available depends on the authorisations in place and on what the administrator of a given deployment has switched on. That changes, and an article does not — so the live answer lives on the feature page, which reads it from the platform itself: Corridor network on the features page.

Read next

• Remittance — The number on the screen is the number they get.
• Settlement and statements — Know what was taken, not just what arrived.
• E-money and safeguarding — Every balance is backed, by construction.