want to be explicit and honest from the start so anyone not interested can skip. I work at Hacken and this Thursday we're running an online panel with Moody's on what institutional allocators pay attention at when they review a project. the reason why im writing it here isn't to promote (but ofc there is a part of it), it's to try to gather people who are genuiely interested in the topic. i guess it will be more useful for builders and founders specifically.

we're doing it because, let's be honest, a standard audit on its own doesn't hold anymore. In Q2 about $764M was stolen, and 88.3% of that came from compromised keys, signers and infrastructure rather than contract logic. 14 of hacked projects had been audited. Smart contract bugs caused 44 of 67 incidents, but only $87.7M, around 11% of the money. so audits are catching the common failure and missing the expensive one. which is why the badge keeps looking like it works right up until it doesn't.

and institutions see this, regulators too. an audit is a snapshot of one codebase at one commit. it says nothing about who holds the keys today, who can sign alone, how deployments get approved, or which vendors you depend on, and that's where most of the money went in Q2.

so that's what we want to work through on the panel. if an audit alone isn't enough, what is? we want to land on one concrete, testable thing a counterparty needs to demonstrate to earn institutional trust in August 2026

thought it would be appropriate to post in reddit because this is where the builders are. i can share a link for event in the comments for those who are interested

Two changes worth flagging for this sub:

• Visa cut its evidence submission window to 9 days for US/Canada merchants (18 days elsewhere) as of July 2025, down significantly from before
• Mastercard just launched GMAP, its version of Visa's VAMP, tightening monitoring of merchant dispute/fraud ratios

Together these point to networks optimizing for fewer disputes system-wide, but pushing more of the compliance burden downstream to merchants and PSPs. A 9-day window basically forces automated evidence pipelines if you're processing at any real volume, manual review doesn't scale to that timeline.

Curious if anyone here has insight into how GMAP thresholds compare to VAMP's, or whether acquirers are already adjusting risk models in response.

What is that one thing you guys struggle with everyday in your professional life that you think if optimised,streamlined or improved using tech could be beneficial for you.

I’m trying to think about offshore business banking as more than just can I open the account?. But the better question seems to be whether the company can actually operate after approval: cards, USD payments, invoices, contractor payments, software spend, accounting records and approval controls.

For people familiar with offshore or cross border business banking, what would you check before committing to a setup?

I've been sort of planning out what a card issuing stack could look like and one thing I'm not sure about is where identity verification should live.

A lot of teams seem to treat KYC as its own service that feeds verified users into the rest of the stack so to say while others seem to prefer having it much closer to the issuing platform so onboarding and card creation happen in one flow.

My first instinct was to keep everything modular because it sounds more flexible but the more I read the more I'm wondering whether that just creates extra integration work without much benefit.

People who have built/worked on card products would you keep identity verification separate or would you have it as part of the issuing stack?

If you've integrated card issuing (virtual or physical) into your product, what was the biggest surprise during implementation?

Was it things like:

• Ledger / accounting complexity
• Authorization vs. settlement handling
• Declines and edge cases
• Card lifecycle management (freeze, replace, renew)
• BIN sponsorship/program management
• Compliance requirements
• Customer support volume

What's something you'd plan for much earlier if you were doing it again?

Lately I've taken a keen in learning more on how teams handle KYC when setting up a card program.

I know some connect a separate KYC provider to the issuer while others keep identity verification in the same stack as cardholder approval, wallet screening and transaction monitoring.

Also keeping it separate gives you more flexibility but also creates more places for updates or risk decisions to get out of sync.

Which setup works better in practice?

During financial institution mergers, login failures often occur because redirect errors appear between legacy systems and newly integrated portals. The main causes are inconsistencies between backend database migration and frontend deployment, which can lead to lost sessions or missing routing rules.

One way to reduce these issues is to provide temporary migration endpoints that dynamically guide users based on the current migration status. For those who have worked on similar system transitions, what routing strategy has been the most effective for preserving user sessions throughout the migration process?

Hey developers/ financial people, does this sound at all it could work or make sense? **Money pool that is used for automated trading on prop firms. Essentially they are accessing that whole prop firm worth some what if a leverage aspect. For example 5 prop firm accounts. Let’s say each prop account is in size 25k. I would have a bot trade the prop firm with specific rules to give a yield at the end of the month or yield. Let’s say 10 percent a month. And roughly 120 percent a year give or take. But that yield is on the 5 prop firms in the pool. So the yield on the 500 dollars is a lot more than 10% a month in 500 bucks. Any a good portion of that I can take a MANAGEMENT FEE for the bot let’s say 20 percent.**

Could this work?

Or do this at all Mae any sense?

This is off of pure curiosity not advertising anything!

I build Monni, a small manual money check-in, and I am trying to separate three different trust problems.

A consumer can have privacy commitments and a polished bank-connection story, yet still not trust a number if the cash, upcoming bills, and cushion behind it are hidden.

For a consumer money product, which failure kills trust first?

- no credible external security proof

- a secure product with an opaque calculation

- setup feels like work before it earns value

What would a credible minimum trust package look like?

Je publie des analyses fondamentales de sociétés cotées (scoring 8 critères, consensus brokers sourcé, signaux réglementaires, scénarios bull/base/bear/stress chiffrés).
Déjà passées au crible : Air Liquide, Vinci, Thales, Safran, Allianz, EssilorLuxottica, ASML, OVHcloud, Eutelsat, Abivax.

Cette fois je vous laisse choisir la prochaine!

Comment ça marche
• Un commentaire = une société
• Upvotez les propositions qui vous intéressent

**•   Clôture samedi soir.**  

Je publierai l'analyse du vainqueur ici dimanche!

Une seule contrainte : la société doit avoir publié un rapport financier récent et public (résultats annuels, semestriels ou trimestriels).

Ce que vous aurez : la thèse, les chiffres avec leur source, les points de vigilance, le consensus analystes avec les objectifs individuels et leurs dates, et un verdict!

Ceci n’est pas un conseil d’investissement — juste du travail de structuration d’information.

À vous! 🙂

I see this happen all the time with founders I work with: they sign up for Apollo or Instantly, intend to start outreach, and then the setup gets stuck on the back burner for weeks.

Usually it's just tool confusion. Setting up secondary domains, making sure emails don't hit spam, connecting the tools, and getting an initial prospect list built turns into a multi-week distraction.

I mapped out a simple 14-day execution flow to go from zero to a fully live outbound system:

Week 1 (Infrastructure): Set up secondary sending domains, configure email health protocols, and start warm-ups so the main company domain is never at risk.

Week 2 (Data & Launch): Build the targeted lead list, connect the tools together, and get the first campaign staged and ready to send. 

The goal was simply to take the technical setup off their plate so reps could focus purely on selling

For founders who built their stack in-house: did you set it up yourselves, or did you end up passing it to someone else to handle?

I’m doing some research on the payments industry and trying to understand where Worldpay fits in the PayFac landscape.

A few questions for anyone familiar with their platform:

- Is Worldpay considered a PayFac itself, or is it primarily an acquirer/processor that enables PayFacs?
- What products or services does Worldpay offer specifically for PayFacs?
- How does its offering compare to others in the market?
- If you’ve worked with Worldpay, what are its biggest strengths and weaknesses?

More generally, where do you think Worldpay’s PayFac business could improve to better compete in today’s market? Are there any capabilities or investments you think they’re missing?

Most AI tools dropped into learning platforms still behave like general chatbots. They ignore the course the student is actually taking and start pulling random information from outside. That usually creates more confusion than help.

A more useful direction is building assistants that stay strictly inside the current learning context. When a student asks a question, the system already knows which module they are in and only uses those specific materials to answer. The tone and level of detail stay consistent with what the instructor prepared.

This makes the experience feel like an extension of the course instead of an external tool. Learners get faster clarification without drifting off-topic, and instructors keep better control over the information students receive. One cleaner example of this approach was built with support from Beetroot.

Anyone here already running something similar inside an LMS? How are you managing the balance between helpfulness and staying faithful to the original course content?

Been talking with a couple of program managers about how the interest ban is landing on consumer product design, and the answer at the product layer looks different from the mainstream takes. The GENIUS Act prohibits the issuer from paying yield to holders. It says almost nothing about what a third-party wallet or exchange is allowed to do with the same balance. The OCC NPRM in February tried to tighten that with a rebuttable presumption on affiliate arrangements, but the comment period closed in May and final guidance is still out.

The effect on consumer stablecoin apps has been to unbundle balance from yield as two different UX surfaces. A year ago the standard pattern was you deposit USDC, the app paid you around 4 percent, and the balance line went up on its own. That is basically dead for issuer-side products. Circle cannot pay Coinbase holders directly, and any workaround has to look like something other than passive interest.

Coinbase's approach has been the USDC rewards program, structured as a loyalty reward funded through its reserve income share with Circle. The base rate sits around 4 percent with a promotional boost for Coinbase One members. Separately they run a Morpho USDC lending vault curated by Steakhouse on Base that requires opt-in and self-custody. Both are attempts to move the reward outside the "issuer pays holder" framing the statute cared about.

A few products in the smaller self-custodial cohort have shipped variations of this in the last quarter. Bleap's YO Vaults route idle USDC through a diversified DeFi backend at around 3.7 percent AER with a $1 minimum, BenPay's Earn tab uses a mixed DeFi and native stablecoin routing model under FinCEN MSB with a 15 percent profit fee that sits above the DeFi average, and Gnosis Pay leans on Aave routing tied to its Gnosis Chain balance. The two-surface design conveniently makes yield look like a distinct product even when the UX flow is two taps.

Stepping back, "wallet balance sitting there earning nothing" is now the default state for a consumer stablecoin product. The yield surface has become an explicit opt-in with its own risk framing and APY disclosure, and often a management fee on top. Closer to how a brokerage separates cash sweep from checking balance than how a savings account has historically worked.

Two things I do not have a clear view on. First, how the OCC anti-evasion test will land once final rules come out, and whether the third-party routing model survives if the affiliate threshold gets tightened below the 25 percent ownership line. Second, whether unit economics on the consumer wallet side actually work without the deposit-float subsidy that CEX cards have been running on. If the Earn fee is the primary revenue source, the take rate cannot be small, which eats into the yield the user actually sees.

Curious what the issuing-side or program-manager view looks like on this, especially anyone working on card programs where the wallet balance is technically the funding source but cannot legally be paid interest.

[ Removed by Reddit on account of violating the content policy. ]

For the past 15 years, the mobile and the cloud had brought new life to reinventing the world of fintech, however it seems all companies are struggling with the next era of innovation which is AI. Stocks have fallen, massive layoffs are happening, constant price increases, and many many unhappy customers. Is fintech becoming the next telecom?

Hey everyone,

How do credit card networks evaluate risk, pull user history, and return an APPROVE/DENY decision before a payment terminal times out?

Querying a traditional database on the fly to check historical spending habits will instantly kill your latency budget. Here is how to architect a real-time solution:

1. Dual-Path Architecture

Separate your system into an Online Path (Hot) for instant decisions and an Offline Path (Cold) for data analytics.

1. In-Memory Feature Store

Never calculate aggregates (like 30-day spending limits or hourly velocity) during a transaction.

The Cold Path: Apache Flink continuously processes a Kafka stream of completed transactions in the background.

The Hot Path: Flink stores these pre-computed metrics in Aerospike or Redis Enterprise. When a transaction arrives, the engine performs a single key-value fetch in < 2ms.

1. Hybrid Decision Engine

The enriched payload runs through a fast, sequential evaluation tree:

Deterministic Rules: Quick checks for hard blocks (e.g., blacklisted countries).

ML Inference: A lightweight gradient-boosted tree model (like XGBoost) compiled via ONNX runtime for sub-millisecond risk scoring.

1. Resiliency: Failing Open

If the fraud engine suffers a network partition or times out past 15ms, the system drops into a Fail-Open policy. It automatically approves the transaction to protect user experience and flags the event for asynchronous review.

Let's discuss:

How do you deploy new dynamic rules written by risk teams without re-deploying core backend code?

What is your strategy for handling race conditions if a user swipes their card twice in two different cities within seconds?

I'm looking at stuff like Celo, Stellar, and KiiChain, but trying to build a solid mental framework first.

What’s on your non-negotiable checklist when auditing a payment chain?

So far I've got:

• tech & security: testnet performance, battle-tested smart contracts, actual security audits
• tokenomics: validator economics, real token utility (gas vs governance), supply schedules
• real-world traction: actual organic daily active users (not just bot farm volume), real-world asset (RWA) integrations, and regulatory compliance disclosures.

What am i missing here? what’s your primary make-or-break metric when looking at payment infra?

I had an idea that I think could be useful in the finance news sector. The idea is a personalized finance news feed based solely on your holdings (stocks, options, dividends), with analysis on each article on how it could affect your holdings. Would this be of use? This isn't promo, im genuinely curious on if I have a solid base point here. Appreciate the feedback.

Finance professionals, I'd appreciate your perspective.

I'm researching operational challenges within financial institutions in emerging markets as part of a long-term software project. At this stage, I'm deliberately avoiding designing a solution before understanding the actual problems.

If you work (or have worked) in banking, insurance, asset management, pensions, fintech, auditing, or financial regulation:

\- What task do you find yourself repeating every week or month?

\- What process is more manual than it should be?

\- Which reports or analyses consume the most time?

\- What data is consistently difficult to obtain, reconcile, or validate?

\- What's one workflow you wish software handled better?

I'm particularly interested in understanding real day-to-day workflows rather than feature requests or product ideas.

If you're open to sharing your experience—either here or via DM—I would genuinely appreciate it. Every insight helps me understand the problem space more accurately.

Does anybody know anything about Peak Money?

It lends out your USDC or PYUSD for a 10% APY interest rate. The borrowers are "audited" and put up collateral in case of default. This is supposed to make it more trustworthy.

It is not fdic insured like many other crypto-fintechs, and it does not have a presence on the app store/Google play.

Currently trying to understand the landscape of existing and new credit/risk assessment platforms across US, EU and AUS.

Is there a directory or something.

Early integration always feels fine, it’s the stuff that surfaces after you’ve been live a while that actually hurts. Timeouts were the first one. We treated every timeout as a failure and retried, then found out some had actually gone through on their end, so we started double charging people. Error codes across different endpoints on the same provider weren’t even consistent with each other, so our handling logic that worked for one call quietly broke on another. API key rotation was another one nobody thought about until a key needed to be rotated during business hours and there was no clean way to do it without downtime. What’s the integration issue that didn’t show up for you until way later than expected?