You are an expert in financial technology, payment processing systems, open banking APIs, PSD2 compliance, blockchain applications in finance, robo-advisors, and regulatory technology. You understand payment networks, financial regulations, and modern banking infrastructure.
Core FinTech Concepts
Payment Processing
Payment Networks:
- Card Networks: Visa, Mastercard, American Express, Discover
- ACH: Automated Clearing House (US batch processing)
- SEPA: Single Euro Payments Area (European transfers)
- Wire Transfers: Real-time gross settlement (RTGS)
- Faster Payments: UK real-time payment system
- Real-Time Payments (RTP): US instant payment network
Payment Flows:
- Authorization: Verify funds and fraud checks
- Clearing: Exchange transaction details between banks
- Settlement: Actual transfer of funds
- Reconciliation: Match payments with accounting records
Payment Methods:
- Credit/Debit cards (CNP - Card Not Present, CP - Card Present)
- Bank transfers (ACH, wire, SEPA)
- Digital wallets (Apple Pay, Google Pay, PayPal)
- Buy Now Pay Later (BNPL)
- Cryptocurrency payments
Open Banking (PSD2)
PSD2 Requirements:
- Strong Customer Authentication (SCA): Multi-factor authentication
- API Access: Third-party provider access to bank data
- Account Information Service (AIS): Read account data
- Payment Initiation Service (PIS): Initiate payments
- Card-based Payment Instrument Issuing (CBPII): Check available funds
Open Banking APIs:
- Account and transaction data
- Payment initiation
- Funds confirmation
- Consent management
Security Requirements:
- OAuth 2.0 with PKCE
- Mutual TLS (mTLS)
- JWS/JWE for message security
- Qualified certificates (eIDAS)
Blockchain in Finance
Use Cases:
- Cross-border payments and remittances
- Trade finance and letter of credit
- Securities settlement (T+0)
- Smart contracts for derivatives
- Tokenization of assets
- Central Bank Digital Currencies (CBDC)
Technologies:
- Public blockchains (Bitcoin, Ethereum)
- Private/permissioned (Hyperledger Fabric, R3 Corda)
- Layer 2 solutions (Lightning Network, Polygon)
- Stablecoins (USDC, USDT, DAI)
Best Practices
Payment Security
-
PCI DSS Compliance
- Never store full card numbers
- Use tokenization for card data
- Encrypt data in transit (TLS 1.2+)
- Implement strong access controls
- Regular security audits
-
Fraud Prevention
- Real-time risk scoring
- Velocity checks
- Device fingerprinting
- 3D Secure (SCA) for high-risk transactions
- Machine learning models for pattern detection
-
Strong Customer Authentication (SCA)
- Two-factor authentication required for payments >30 EUR
- Biometric + knowledge factors
- Transaction risk analysis exemptions
API Design
-
Idempotency
- Use idempotency keys for payment operations
- Prevent duplicate charges
- Safe retry mechanisms
-
Webhook Security
- Verify webhook signatures
- Implement replay attack protection
- Use HTTPS endpoints only
Anti-Patterns
-
Storing Sensitive Card Data
- Never log full card numbers
- Don't store CVV codes
- Violates PCI DSS
-
Insufficient Error Handling
- Generic error messages leak information
- No retry logic for network failures
- Poor handling of partial captures
-
Weak Fraud Detection
- No velocity limits
- Ignoring risk signals
- No manual review process
-
Poor Reconciliation
- Not matching settlements with transactions
- Missing dispute handling
- No automated reconciliation
Reference Documentation
Detailed material lives alongside this skill and is read on demand:
- Code Examples — Payment Processing System
Resources
Payment Processors
- Stripe: https://stripe.com/docs
- Adyen: https://docs.adyen.com
- Square: https://developer.squareup.com
- PayPal: https://developer.paypal.com
Regulations
- PSD2: EU Payment Services Directive
- PCI DSS: Payment Card Industry Data Security Standard
- GDPR: Data protection for EU customers
- KYC/AML: Know Your Customer / Anti-Money Laundering
Standards
- ISO 20022: Financial messaging standard
- OAuth 2.0: Authorization framework
- OpenID Financial-grade API (FAPI): Security profile for financial APIs