Unit 01 · Chapter 5 · 9 min read

Ledgers, reconciliation, and settlement risk

Make balances explainable and prevent money from appearing twice.

The bank says $9,970. The processor says $10,000. The app says everyone has been paid. No one is lying; the $30 fee is missing from one view. A ledger is the part of a fintech that must be less imaginative than its marketing.

Record balanced obligations

Double-entry accounting records each event with equal total debits and credits. It helps expose incomplete entries, but a balanced journal can still be wrong. Two incorrect accounts can balance perfectly. Use account definitions, posting rules, and event references alongside the arithmetic.

For a simplified incoming $100 customer balance, debit cash and credit a customer liability. The firm holds an asset and owes the customer. This is not automatically revenue. Keep a chart of accounts that distinguishes customer funds, fees, receivables, reserves, and settlement clearing. Accounting treatment in a real product requires the relevant professional policy.

A simplified platform ledger might record an increase in cash at a settlement bank and an equal increase in the amount owed to merchants. The entry balances, but that fact alone does not prove that the bank actually received the money. A balanced ledger can faithfully record a wrong assumption. Independent settlement and bank records supply the external evidence needed to test the assumption.

The choice of accounts also communicates the business model. Customer obligations, merchant obligations, fees, reserves, and amounts awaiting investigation should have clear meanings. Do not use a suspense account as a permanent home for unexplained differences. Assign an owner, an age, a reason, and a resolution path to each unresolved item. The longer an item stays unexplained, the less useful a single aggregate cash total becomes.

Record balanced obligations Record balanced obligations — the flow Follow the sequence. Balance and validate account meaning. Event Identify the economic change Post Use defined debit and credit accounts Check Balance and validate account meaning — Follow the sequence. Balance and validate account meaning. Chapter sources · Open image

Record balanced obligations Record balanced obligations — the distinction These concepts answer different questions. Read each definition in the context of the section. Cash asset Money held by the firm Customer liability Money the firm owes a customer — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Record balanced obligations Illustrative journal Fictional teaching record. Deposit is not a fee. Illustrative journal Illustrative data; not a real customer record or a prescribed policy. Debit cash 100 USD Asset increase Credit customer liability 100 USD Obligation increase Revenue 0 USD Deposit is not a fee Holding money differs from earning it — Fictional teaching record. Deposit is not a fee. Chapter sources · Open image

Record balanced obligations Record balanced obligations — control and failure modes Holding money differs from earning it. The branches show why alternative designs fail. Control design It can create an equal customer liability. Holding money differs from earning it. Failure mode 1 Every cash receipt is profit. Cash and income are different concepts. avoid Failure mode 2 Balanced journals prohibit liabilities. They can record both assets and liabilities. avoid Failure mode 3 The payment reference decides revenue. Accounting meaning requires a posting rule. avoid — Holding money differs from earning it. The branches show why alternative designs fail. Chapter sources · Open image

Make retries financially idempotent

Idempotency means repeating a logical operation does not repeat its intended effect. Bind the key to a defined operation and payload. A retry of the same payment should reuse the key; a genuinely new payment needs a new one. Reject conflicting reuse rather than silently changing the amount.

Provider idempotency is one boundary, not the whole system. Use unique journal-event constraints and transactional posting in your own database. A webhook can arrive twice, or a worker can crash after posting but before acknowledgment. The database must make duplicate money creation impossible within the defined operation, even when delivery is at least once.

Idempotency requires agreement about the boundary of one intended action. Reusing the same key for the same refund should return the existing result. Reusing it for a different amount should produce a controlled conflict under the chosen contract. Database uniqueness, stored request fingerprints, and transactional writes can help enforce that boundary. The protection must survive concurrent requests and process restarts. An in-memory list of recently seen keys disappears at exactly the moment a recovering service may receive a wave of retries.

Make retries financially idempotent Make retries financially idempotent — the flow Follow the sequence. Return the prior operation result. Identify Stable logical operation key Commit Post once under a unique constraint Retry Return the prior operation result — Follow the sequence. Return the prior operation result. Chapter sources · Open image

Make retries financially idempotent Make retries financially idempotent — the distinction These concepts answer different questions. Read each definition in the context of the section. Duplicate delivery Same event arrives again New obligation Different business event needs a new entry — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Make retries financially idempotent Retry specimen Fictional teaching record. One financial effect. Retry specimen Illustrative data; not a real customer record or a prescribed policy. Operation pay-71 Stable payment identity Attempt 3 Transport count only Journal entries 1 set One financial effect Transport retries must not create new value — Fictional teaching record. One financial effect. Chapter sources · Open image

Make retries financially idempotent — control and failure modes

Control design

A unique event constraint at the journal boundary. Transport retries must not create new value.

Failure mode 1avoid: A dashboard warning tomorrow. That detects damage after posting.
Failure mode 2avoid: A random new payment identifier. It hides the duplicate.
Failure mode 3avoid: Only a client-side button lock. Workers can retry without the client.

Transport retries must not create new value. The branches show why alternative designs fail. Chapter sources · Open image

Reconcile independent records

Reconciliation compares records that describe the same obligations from different systems. Match transaction-level references first, then check aggregate totals. Equal totals can hide two offsetting errors. A missing $100 credit and an extra $100 credit can cancel in a summary.

Classify breaks as timing, fee, currency, duplicate, missing, or unexplained. Assign an owner and aging limit. Do not force-match a break merely to make a report green. Store the matching rule and supporting records so the resolution can be reproduced. Automated matching is valuable when its exceptions remain visible.

Reconcile independent records Reconcile independent records — the flow Follow the sequence. Post or correct with evidence. Match Connect independent references Explain Classify differences Resolve Post or correct with evidence — Follow the sequence. Post or correct with evidence. Chapter sources · Open image

Reconcile independent records Reconcile independent records — the distinction These concepts answer different questions. Read each definition in the context of the section. Total equality Aggregate amounts agree Item agreement Individual obligations also match — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Reconcile independent records Settlement comparison Fictional teaching record. Gross less fee. Settlement comparison Illustrative data; not a real customer record or a prescribed policy. Processor gross 10000 USD Sales before fee Fee 30 USD Explicit deduction Bank receipt 9970 USD Gross less fee The difference reconciles to an identified item — Fictional teaching record. Gross less fee. Chapter sources · Open image

Reconcile independent records Reconcile independent records — control and failure modes The difference reconciles to an identified item. The branches show why alternative designs fail. Control design The documented $30 fee. The difference reconciles to an identified item. Failure mode 1 Automatic fraud. The facts support a fee explanation. avoid Failure mode 2 A $30 customer refund. No refund evidence was supplied. avoid Failure mode 3 An exchange gain. No currency conversion was stated. avoid — The difference reconciles to an identified item. The branches show why alternative designs fail. Chapter sources · Open image

Distinguish liquidity from solvency

A solvent firm can still lack cash at the moment a payout is due. Assets may be illiquid or arrive after the obligation. A liquidity view therefore needs timing, eligible funding sources, currencies, and stress assumptions. A single end-of-day balance can hide an intraday shortfall.

Build a cash ladder: opening usable funds, expected inflows, committed outflows, and buffer. Separate certain inflows from optimistic forecasts. If a settlement partner delays funding, determine which obligations can still be met and which require an approved contingency. Customer funds and restricted reserves are not a general-purpose emergency wallet.

Distinguish liquidity from solvency Distinguish liquidity from solvency — the flow Follow the sequence. Use approved funding sources. Forecast Time-specific available funds Stress Delay uncertain inflows Respond Use approved funding sources — Follow the sequence. Use approved funding sources. Chapter sources · Open image

Distinguish liquidity from solvency Distinguish liquidity from solvency — the distinction These concepts answer different questions. Read each definition in the context of the section. Solvency Assets relative to obligations Liquidity Usable funds at the required time — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Distinguish liquidity from solvency Illustrative cash ladder Fictional teaching record. Cannot fund today automatically. Illustrative cash ladder Illustrative data; not a real customer record or a prescribed policy. Available now 80000 USD Eligible cash Due now 100000 USD Committed payouts Arrives tomorrow 50000 USD Cannot fund today automatically Today requires $100,000 against $80,000 available — Fictional teaching record. Cannot fund today automatically. Chapter sources · Open image

Distinguish liquidity from solvency Distinguish liquidity from solvency — control and failure modes Today requires $100,000 against $80,000 available. The branches show why alternative designs fail. Control design $20,000. Today requires $100,000 against $80,000 available. Failure mode 1 Zero because tomorrow brings cash. Tomorrow does not meet today without funding. avoid Failure mode 2 $50,000. That is the later inflow. avoid Failure mode 3 $180,000. Adding cash and obligations does not measure a gap. avoid — Today requires $100,000 against $80,000 available. The branches show why alternative designs fail. Chapter sources · Open image

Reverse with a trace

Correct mistakes with linked entries and a reason. Deleting a journal record removes the explanation of what the system believed and when. A reversal should reference the original entry and preserve approval evidence. Recompute downstream balances from the corrected history.

Use permissions that separate preparation from approval for high-impact adjustments. Monitor manual adjustments by count, value, account, and operator. A pattern of tiny adjustments may indicate a rounding defect; a few large adjustments may indicate a mapping error or misuse. The goal is an explainable trail, not a journal that appears never to have made a mistake.

Reverse with a trace Reverse with a trace — the flow Follow the sequence. Reconcile the corrected balances. Detect Identify the incorrect posting Reverse Link an authorized correction Verify Reconcile the corrected balances — Follow the sequence. Reconcile the corrected balances. Chapter sources · Open image

Reverse with a trace Reverse with a trace — the distinction These concepts answer different questions. Read each definition in the context of the section. Deletion Erases the historical explanation Linked reversal Preserves the event and its correction — These concepts answer different questions. Read each definition in the context of the section. Chapter sources · Open image

Reverse with a trace Correction specimen Fictional teaching record. Uses approved account mapping. Correction specimen Illustrative data; not a real customer record or a prescribed policy. Original journal-18 Wrong clearing account Reversal journal-24 Offsets journal-18 Replacement journal-25 Uses approved account mapping The history remains explainable — Fictional teaching record. Uses approved account mapping. Chapter sources · Open image

Reverse with a trace Reverse with a trace — control and failure modes The history remains explainable. The branches show why alternative designs fail. Control design A linked reversal and correct replacement. The history remains explainable. Failure mode 1 Delete it without a record. That destroys the audit trail. avoid Failure mode 2 Change all customer balances manually. That bypasses event meaning. avoid Failure mode 3 Hide it from reconciliation. The obligation still needs resolution. avoid — The history remains explainable. The branches show why alternative designs fail. Chapter sources · Open image

Chapter connections

This chapter builds on Instant payments and cross-border transfers. Use the glossary for terminology and risk mathematics for formulas and worked calculations.

Sources

Reviewed 2026-09-17