A payments platform through two custodial-bank transitions
ACH and check disbursement, bank-file integration and reconciliation, carried through two changes of custodial bank without a late payment.
The constraint
Retirees get paid monthly. The platform behind that handles ACH and check disbursement, the files that go to and come back from the custodial bank, and the reconciliation that proves every cent landed. Twice in its life the custodial bank changed, and each time the file formats, the notices and the timing changed with it. The one thing that couldn't change was the payment date.
The decision
The bank is an adapter. The ledger is ours. Reconciliation runs against our record of what should have been paid, not against whatever the bank's file says, so a new bank means a new adapter and the same reconciliation. The nightly notice-of-change files, where the bank reports a changed account, were automated instead of being worked by hand. And because a payment change is where fraud happens, changes to a retiree's payment details got their own review workflow with segregation of duties the system enforces.
What it cost
For each transition, a parallel run and a reconciliation to the cent before the switch. There's no partial credit in payments.
What shipped
The platform ran through both transitions with payments on time. The review workflow for payment changes and the automated notice-of-change processing are still in use.
What it showed
The controls live at the boundary. Inside the platform the rules are ours and testable. At the edge, where money and another institution meet, every file is evidence and every change to where money goes is a decision somebody has to own. Agent systems have the same boundary, at the tool call, and I treat it the same way.