Most payout failures are not algorithmic — they are operational. A payout engine that looks correct in a happy-path demo breaks the moment you add retries, partial failures, reconciliation and a regulator asking for a complete audit trail.
Idempotency is the foundation
Every payout request must carry a client-generated idempotency key persisted before the first attempt. Without it, a retried network call becomes a double payment. We model the payout as a state machine — requested → authorized → submitted → settled / failed — and never delete rows. State transitions are append-only events.
Reconciliation is a first-class feature
Provider webhooks lie, arrive twice, or never arrive. The system of record is your ledger, not the provider. We run a daily three-way reconciliation between internal ledger, provider report and bank statement, and surface breaks before finance does.
Compliance is built in, not bolted on
KYC status, sanctions screening and transaction limits are evaluated at authorization time, not after the money leaves. Every decision is logged with the inputs that produced it, so an auditor can replay any payout months later.
This is the difference between a payment feature and a payment platform.