Regulated, legacy-bound, and expected to ship weekly.

Yes, and we would rather improve it than route around it. Teams shipping weekly under supervision did not get an exemption — they made the evidence a by-product of the pipeline, so approval reviews an artefact that already exists. That is usually a smaller change than it sounds.

It has applied since January 2025 and it changes what has to be demonstrable rather than merely true. Incident reporting timelines, third-party risk registers, resilience testing and exit plans all need evidence somebody can produce on request. We build systems that emit that evidence rather than assembling it afterwards.

That is the normal requirement and it shapes the approach. Change moves behind a facade in slices, with the old and new paths running together and traffic shifted gradually. It is slower than a cutover and it is the only version that does not put the business at risk on a single weekend.

With the assumption that everything fails eventually and reconciliation is the real product. Idempotency, exactly-once semantics where it matters, replay-safe processing and a settlement view that can be checked independently. The interesting engineering in payments is what happens on the unhappy path.

It is designed to. Threat modelling, dependency scanning, secrets management and audit trails sit in the pipeline rather than in a pre-launch checklist. We ask for your control framework at the start so the evidence is produced as we go, which is faster for both sides than a review that finds gaps late.

Yes, and it is the common arrangement. The split usually falls between a long-cycle platform partner and us taking work that needs to move faster or sit closer to the business. What matters is that ownership of each interface is written down, because unowned boundaries are where these programmes lose months.