Payment Intelligence Architecture: How Tanqory Designs Flexible Payment Logic

Payment Intelligence Architecture: How Tanqory Designs Flexible Payment Logic
Research blog — architecture, methods, and evidence for AI-native payments

Executive Summary

Modern payment stacks are no longer static gateways; they are decision systems. Tanqory’s payment intelligence architecture ingests heterogeneous signals (device, issuer, risk, cost, latency), applies causal and predictive reasoning, and orchestrates routing and policies in real time with fairness, compliance, and trust constraints. This post describes the Payment Signal Mesh (PSM) and Orchestration Layer (OL) that make payment logic flexible, safe, and performant across regions.

Key ideas:

• Event-first ingest with consent/residency and schema contracts; reduces brittle batch dependencies.
• Causal and synthetic-control methods separate signal from noise in authorization outcomes (Athey and Imbens, 2016; Abadie et al., 2010).
• Contextual bandits and planners optimize routing under risk, cost, and latency constraints (Agarwal et al., 2014; Patil et al., 2021).
• Control-inspired regulators stabilize KPI variance during traffic spikes (Box et al., 2015; Deng et al., 2013).
• Governance: audit-ready logs, consent/residency enforcement (Dwork and Roth, 2014), and experiment registries (Kohavi et al., 2020).

1. Payment as a Decision System

1.1 The Limits of Static Routing

• Static priority lists ignore real-time issuer behavior and corridor conditions.
• Correlation-based rules misread causality; confounding (traffic mix, seasonality) skews uplift claims (Pearl, 2009).
• Batch updates lag behind fraud patterns or issuer policy changes.
• Compliance and consent checks bolted on; increase risk and inconsistency.

1.2 Consequences

• Higher decline rates and retries; user churn.
• Excessive cost when fallback rails overused.
• Latency spikes from inefficient routing; conversion loss.
• Compliance risk if consent/residency not enforced on-path.

1.3 Tanqory’s Approach

Treat payments as an event-driven control loop. Sense signals continuously; apply causal and predictive models; execute with constraints on risk, cost, latency, fairness, and compliance; observe and adjust rapidly.

2. Design Principles

1. Event-first: every authorization, risk check, and handoff is an event with schema, consent, and residency flags.
2. Causal preference: uplift, synthetic controls, and natural experiments over naive correlations (Athey and Imbens, 2016; Abadie et al., 2010).
3. Constraint-aware: risk, cost, latency, fairness, privacy enforced at decision time (Patil et al., 2021; Dwork and Roth, 2014).
4. Separation of reasoning and execution: PSM senses/reasons; OL executes with rollback.
5. Human-in-the-loop: high-impact changes reviewed; explanations provided (Lundberg and Lee, 2017).
6. Multi-region readiness: per-region routing, compliance, and fairness thresholds.
7. Observability: trace from event to decision to outcome; exportable for auditors (Kohavi et al., 2020).

3. Architecture Overview

3.1 Payment Signal Mesh (PSM)

• Ingest and Contracts: Kafka-like bus; schema registry; consent/residency tagging; dedupe and watermarking for late events (Kleppmann, 2017).
• Signal Normalization: enrich with device, issuer BIN range, channel, merchant, corridor, amount, currency.
• Feature Store: online/offline parity; freshness SLAs; lineage for audit.
• Quality Monitors: null thresholds, distribution drift (Kullback and Leibler, 1951), volume anomalies.

3.2 Orchestration Layer (OL)

• Causal Services: uplift estimation for routing strategies; synthetic controls for A/B-infeasible corridors.
• Predictive Models: risk scores, authorization propensity, latency forecasts; boosted trees (Chen and Guestrin, 2016) and lightweight transformers (Vaswani et al., 2017) under p95/p99 budgets.
• Policy Engine: contextual bandits with fairness/latency/cost constraints (Agarwal et al., 2014; Patil et al., 2021); planners for multi-step flows (risk → routing → retries → offers).
• Safety Layer: consent/residency checks, bias scans, p95/p99 latency guards, cost caps, fraud thresholds.
• Action Connectors: gateways, alternative payment methods (APMs), fraud services, ledger, notification systems.

4. Signal Taxonomy

4.1 Transaction and Device

• Amount, currency, MCC, merchant, BIN range, issuer country.
• Device fingerprint, OS, browser, app vs web; IP geolocation; network quality.

4.2 Behavioral and Session

• Session recency, cart changes, retries, abandonment signals.
• Channel source; referral; loyalty status; historical success/failure.

4.3 Risk and Trust

• Fraud scores, velocity checks, chargeback history.
• Dispute rates by issuer and corridor; trust posture (Gefen et al., 2003).
• Payment retries and decline codes; error taxonomies.

4.4 Cost and Performance

• Gateway and APM fees; FX spreads; tax/fee implications.
• Latency per gateway/corridor; timeouts; jitter.
• Reliability: success rate, p95/p99 latency; fallback hit rate.

4.5 Compliance

• Residency/consent flags; regional data handling rules.
• Eligibility constraints (age, product, geo).
• Sanctions/AML flags where applicable.

5. Causal and Predictive Modeling

5.1 Uplift and Experiments

• Doubly robust uplift for routing and retries (Athey and Imbens, 2016).
• Synthetic controls for corridors where experiments are impractical (Abadie et al., 2010).
• Sequential tests to avoid peeking bias (Johari et al., 2017).
• CUPED for variance reduction in volatile periods (Deng et al., 2013).

5.2 Risk and Propensity Models

• Authorization propensity: boosted trees with monotonic constraints for stability (Chen and Guestrin, 2016).
• Fraud/risk: ensemble models; calibrated scores; fairness checks.
• Latency forecasting: time-series models to anticipate congestion (Box et al., 2015).

5.3 Explainability

• SHAP for tree models (Lundberg and Lee, 2017); operator dashboards.
• Counterfactual prompts: what if reroute to gateway B? what if retry after delay?
• Influence shift alerts for sudden issuer behavior changes.

6. Decision Policies and Constraints

6.1 Routing and Retries

• Contextual bandits choose primary/secondary gateways/APMs; fairness caps on exposure.
• Retry logic conditioned on decline codes and latency; avoid thrashing users.
• Cost-aware routing: balance fees, FX, and success probability.

6.2 Offers and Recovery

• Recovery flows (alternative payments, split pay) triggered based on propensity and risk.
• Fairness and fatigue: avoid over-targeting specific cohorts; respect opt-outs.
• Transparent messaging to preserve trust.

6.3 Control-Inspired Smoothing

• Regulators to dampen routing changes during spikes; prevent KPI whiplash.
• Thresholds for automatic rollback when variance or latency exceeds bands.

7. From Signals to Actions

7.1 Real-Time Routing

• Choose gateway/APM per transaction with on-path checks (consent, residency, eligibility).
• Apply risk filters; adjust 3DS/step-up policies by corridor and risk level.
• Enforce latency SLOs; fallback to cached policies when upstreams degrade.

7.2 Pricing, Fees, and FX

• Route to minimize total cost while preserving success; consider FX spreads and tax.
• Avoid overusing expensive rails unless uplift justifies cost.
• Align with regulatory fee caps per region.

7.3 Fraud and Trust

• Dynamic risk thresholds; adjust friction (OTP, step-up) based on risk.
• Monitor dispute spikes; adjust routing or friction; communicate transparently.

7.4 Notifications and UX

• Timely user messaging on failures and alternatives; avoid spam via frequency caps.
• Clear error taxonomy mapped to actions; localized content.

8. Observability, Reliability, and Governance

• Metrics: authorization rate, retry success, latency p95/p99, timeout rate, cost per 1k transactions, fairness gap, fallback hit rate.
• Tracing: request IDs across ingest → features → decision → gateway; log policy version, model hash, cohort tags.
• Experiment registry: hypotheses, guardrails, rollback triggers (Kohavi et al., 2020).
• Audit trails: consent/residency proof, policy changes, access logs; exportable for regulators.

9. Multi-Region Adaptation

• Region-specific latency budgets, fee constraints, and fairness thresholds.
• Localization of decline-code taxonomies, regulatory rules, and messaging.
• Hierarchical priors to handle data sparsity in new corridors; conservative exploration.
• Isolation and kill switches per region and per gateway.

10. Experimentation Framework

• Pre-registered hypotheses; MDE defined.
• Sequential testing (Johari et al., 2017); CUPED (Deng et al., 2013).
• Holdouts for drift and bias monitoring; bias/fairness guardrails.
• Policy scorecards: uplift, variance, fairness, latency, cost.

11. Performance and Cost Engineering

• Latency budgets: ingest (10-20ms), feature read (20-30ms), decision (25-40ms).
• Caching: hot features; safe fallback policies.
• Cost dashboards: per-gateway/APM cost and ROI; prune low-ROI policies.
• Chaos drills: simulate gateway outages; replay harness for surge traffic.

12. Security, Privacy, and Compliance

• Least privilege IAM; secrets vault; mTLS.
• PII hashing; redaction in logs; residency enforcement.
• Consent and opt-outs enforced on-path; DPIA for new signals (Dwork and Roth, 2014).
• Compliance filters: sanctions/AML flags; eligibility checks; audit-ready evidence.

13. Case Studies (Illustrative, Evidence-Aligned)

• EU Fashion: issuer-specific reroutes improved auth +4.9%; synthetic controls confirmed uplift beyond seasonal noise (Abadie et al., 2010).
• US Marketplace: control-inspired smoothing cut latency variance 18% during peak; stable auth rate maintained (Box et al., 2015).
• APAC Digital Goods: alternative payments offered on decline codes recovered 6.2% of at-risk orders; fairness gaps <4pp (Patil et al., 2021).
• LATAM Cross-Border: FX-aware routing reduced fees 7% with flat success; aligns with cost+auth tradeoff.
• MEA Subscriptions: fraud spike detected; step-up enforced regionally; disputes normalized within 72 hours; trust preserved (Gefen et al., 2003).

14. Data Products and Interfaces

• Decision APIs: routing choices, risk scores, and friction levels with metadata (policy version, confidence, fairness status).
• Analyst workspace: semantic layers; notebooks for uplift, drift, and latency analyses.
• Partner reporting: exposure transparency, performance with confidence bands, fee/FX summaries.
• Signal health index: freshness/quality per feature; auto-suppress risky signals.

15. Operator Workflow

1. Intake: new corridor/signal proposal with DPIA checklist.
2. Design: causal graph, metrics, guardrails, rollout plan.
3. Build: features/models; schema/freshness/drift tests.
4. Validate: offline eval, simulation, privacy/fairness review.
5. Launch: shadow → gated ramp; observability on.
6. Operate: monitor metrics; trigger playbooks on anomalies.
7. Review: postmortems; update thresholds and playbooks.

16. Technical SLAs and Playbooks

• Ingest 99.9%; schema reject <0.1% post-launch; freshness <5 minutes for critical signals.
• Feature store p95 read <30ms; alerts at 90% freshness.
• Decision p95 <100ms, p99 <150ms; timeout budget <0.5%.
• Playbooks: data quality, drift, fairness, latency, cost spikes, fraud surges; rollback trees defined.

17. KPI Math

• Auth rate, retry success, cost per 1k, latency p95/p99, fairness gap, fallback hit rate, dispute rate.
• Fairness gap = max uplift - min uplift across cohorts; halt if >5pp for >1 hour.
• Drift score: KL vs 7-day baseline; investigate >0.08; rollback >0.12.
• Cost ROI: (uplifted revenue - incremental fees)/baseline revenue.

18. Limitations and Open Questions

• Unobserved confounding: issuer policy changes not always observable; causal claims need caution (Pearl, 2009).
• Data sparsity: new corridors have low volume; conservative exploration needed.
• Attribution: multi-touch journeys (offers + routing) complicate uplift attribution.
• Adversarial noise: fraud patterns evolve; continuous detection required.
• Human factors: operator interpretation of explanations varies; UX research needed.
• Sustainability: energy/carbon not yet in reward; roadmap to integrate.

19. Future Research Directions

• Bayesian bandits with fairness and latency constraints.
• Federated/on-device scoring to reduce latency and data movement.
• Causal discovery with feedback-loop tolerance; region stability checks.
• Carbon-aware routing objectives.
• Explainability UX for ops; reduce cognitive load.
• Trust integration: coordinate fraud, content safety, and payment policies.

21. KPI Math and Thresholds

• Authorization rate: primary success metric; segmented by corridor, issuer, device.
• Retry success rate: recovered conversions post-decline.
• Cost per 1k: (fees + FX + tax)/1k transactions; tied to ROI.
• Latency: p95/p99; rollback if breached >15 minutes.
• Fairness gap: max uplift - min uplift across protected cohorts; halt if >5pp for >1 hour.
• Drift score: KL vs 7-day baseline; investigate >0.08; rollback >0.12.
• Fallback hit rate: fallback/total decisions; leading indicator of instability.
• Dispute rate: disputes/orders; monitored by issuer/corridor.

22. Technical SLAs and Playbooks

• Availability: ingest 99.9%; decision service 99.9%; feature store 99.5%.
• Latency budgets: ingest (10-20ms), feature read (20-30ms), decision (25-40ms).
• Playbooks:
  • Data quality: quarantine → backfill with lineage → replay decisions → communicate deltas.
  • Drift: fallback → recalibrate → shadow-test → re-ramp.
  • Fairness: halt → analyze gaps → adjust constraints → retest.
  • Latency: switch to lightweight policy → scale infra → profile hotspots.
  • Cost spikes: reroute to lower-cost rails with acceptable auth.
  • Fraud surge: tighten thresholds; add friction selectively.

23. Partner and Stakeholder Reporting

• Merchants/partners: routing rationale, performance with confidence bands, fee/FX summaries, fairness snapshots.
• Internal: weekly scorecards (auth, cost, latency, fairness, disputes); incident timelines.
• Regulators/auditors: residency/consent proof, policy changes, experiment registry exports.
• Feedback loops: partner flags become labeled data to refine routing and risk models.

24. Training and Change Management

• Onboarding: causal reasoning, fairness, and latency budgets for PM/DS/Eng.
• Runbooks: per region/gateway; include rollback trees and DPIA checklists.
• Review boards: approve high-impact policy changes; sign-offs logged.
• Documentation debt: tracked and cleared before major ramps.

25. UX and Communication Principles

• Clarity: error and retry messages explain options; avoid dark patterns (Thaler and Sunstein, 2009).
• Localization: decline reason phrasing and APM suggestions localized.
• Friction tuning: add step-up only when risk justifies; minimize user burden.
• Opt-outs and preferences: respect user choices on payment methods where applicable.

26. Content Safety and Abuse Prevention

• Abuse flags: detect multi-account or scripted retries; throttle; route to review.
• Content safety: ensure notifications and offers comply with regional rules.
• Isolation: noisy or suspicious traffic segmented to protect broader population.

27. Future Integration Points

• Supply chain signals: blend promise reliability into routing/pay-later offers.
• Pricing systems: align fees/FX optimization with pricing experiments.
• Trust systems: tighter coupling with fraud and content safety to coordinate responses.
• Sustainability: explore carbon-aware choices where rails differ in energy footprint.

20. Conclusion

Payments are a living system. By treating routing, risk, and offers as event-driven, causal, and constraint-aware decisions, Tanqory reduces decline pain, controls cost, and preserves trust. The PSM and OL architecture keeps payments resilient, auditable, and adaptive across corridors and conditions.