A ledger that clears 40,000 payments a minute

Northbank settled card and ACH volume on a ledger that mutated balances in place, so the only record of what a balance used to be was last night's snapshot. Reconciliation locked accounts while it ran. Month-end close took nine hours with two people watching a progress bar, and one failed batch meant restoring the snapshot and replaying by hand from a runbook whose fourth step was, literally, ask Marco. Their auditors had started asking who was able to edit a balance directly, and nobody enjoyed the honest answer.

We remodelled the ledger as append-only double entry, which turns a balance into a projection rather than a number anyone can overwrite. Every posting is idempotent on the digest of the signed request that produced it, so replays are safe and the audit trail is the system itself instead of a report assembled afterwards. Partitioning the journal by settlement account got writes scaling sideways across the cluster. Then the unglamorous part: the new core ran in shadow against live traffic for eleven weeks, reconciling hourly against the old engine, and we did not move a single customer balance until the two agreed to the cent for thirty consecutive days.

The ledger holds 40,000 postings a minute at sustained peak with roughly three times that in headroom on the current cluster. Close fell from nine hours to twenty-two minutes and runs unattended — the first month nobody was rostered to watch it, someone came in anyway. Compute per thousand postings is down 68%. The SOC 2 Type II audit closed with no findings against the ledger, and ask Marco is no longer a step in anything.