_FINANCIAL-OPERATIONS/
How to Automate Reconciliation Across Multi-Rail Money Movement
By Formance Staff
Reconciliation
Guide
Flows
Loading article content
Loading table of contents
Loading author
In June 2020, EY auditors stopped signing off on Wirecard's accounts because they could not confirm €1.9 billion in escrow balances, which the books said were held in two Philippine banks. For months, EY had received copies, scans, and PDFs routed through intermediaries, never an original confirmation direct from the bank. When BDO Unibank and the Bank of the Philippine Islands finally issued public statements, they confirmed they had never held an account for Wirecard. The €1.9 billion was roughly a quarter of the balance sheet, and it had never existed. Wirecard filed for insolvency seven days later.
The fraud was elaborate, but the underlying failure was ordinary: internal records did not match the external banking records, and for years, nobody forced a direct, evidence-based reconciliation between the two. Every payment platform faces a smaller version of this every day. Your ledger says one thing, your bank statement says another, and your PSP settlement file says a third. Without continuous matching against an immutable source of truth, drift accumulates silently.
Each payment rail brings its own settlement clock, file format, identifier scheme, and finality model. Without continuous matching against a single source of truth, issues compound across settlement windows until finance discovers them at month-end, and an engineer spends two days tracing a discrepancy through code that only the original author understood.
Automated reconciliation across multiple rails prevents issues from becoming balance-sheet problems.
Automated reconciliation is the continuous matching of internal ledger records against external bank and PSP statements to confirm every money movement is accounted for. It pulls data from multiple sources, identifies discrepancies by transaction ID, amount, date, and reference, and flags when issues require human review.
An automated reconciliation pipeline has five parts running on a schedule:
Every match and every review leaves an immutable trail, so when an auditor asks why a balance moved on a given day, the answer is one query away.
However, teams without this pipeline find specific issues:
Both only relocate manual work, whereas real automation means continuous matching against a single record, with an immutable transaction history produced as a byproduct.
Automation matters when you have multiple rails because settlement clocks diverge, file formats don't agree, and the cardinality between PSP transactions and bank credits is rarely one-to-one.
Every rail runs on a different settlement clock, and that divergence is the core reason multi-rail reconciliation is harder than single-rail.
Instant rails settle in real time and are generally irrevocable. ACH follows a batch cadence and settles later, so reconciliation windows cannot assume real-time settlement. Fedwire settles immediately and is final and irrevocable. Card payments are authorized separately from clearing and settlement, and chargebacks can land after settlement.
Data format incompatibility compounds the timing problem. ACH is a flat file, while ISO 20022 is hierarchical XML. Even when the underlying information is identical, the structural representation differs.
Provider settlement files differ in payout fields, time zones, status codes, and transaction history links, so the normalization layer must handle these differences before matching begins.
Cardinality breaks naive 1:1 matching because the PSP-to-bank leg is rarely one-to-one. Incoming payments usually reconcile 1:1 on the order-to-PSP leg, but the PSP-to-bank leg is typically N:1: many PSP transactions batch into a single bank credit shown as a net amount with no transaction-level breakdown.
Configure that leg as 1:1, and you get systematic mismatches. Automation is the only way for the work to scale with the rails.
Automating reconciliation involves implementing these five steps: deciding what you need to reconcile across your rails, gathering and preparing data, setting up appropriate reconciliation tools, automating data comparisons, and rolling it out in phases.
Define exactly what each rail requires you to match before building anything, because the rules differ by rail, and getting this wrong creates false exceptions that bury the real ones. List every party that touches money and every transaction state that each rail can produce.
The two reconciliation types that cover the execution. Transaction reconciliation matches internal ledger records against external provider records one-for-one, while settlement reconciliation bundles many transactions into a single net payment. Your rules have to decompose that net figure before you can match individual transactions against it.
Next, for each rail, capture the settlement window, finality model, reversibility rules, remittance constraints, and identifier scheme. Digital asset rails have a different finality model because on-chain confirmation may provide technical finality, but technical finality is not legal finality. These details become the time-window tolerances and matching dimensions your rules engine enforces later.
Reconciliation only works if you have a single, authoritative record to reconcile against. Use a reconciliation-grade operational ledger where every money movement is modeled with double-entry accounting, immutability, and bi-temporality.
You need the four invariants to make a ledger reconciliation-ready:
Here is what those invariants look like, written in Numscript, Formance's purpose-built language for describing financial transactions.
The situation models a wallet top-up in which $50,000 enters via a bank rail and lands in a customer's wallet. The bank boundary account runs negative on purpose: that negative balance is the cumulative record of how much real money crossed the boundary, and it is exactly what you reconcile against the bank statement.
| Real-world party | Ledger account | Holds |
| The platform's bank rail | @platform:banks:chase:main | Cumulative cash crossing the Chase boundary |
| Alice (customer) | @users:alice:wallet | Alice's spendable balance |
$50,000 enters the platform via the Chase bank rail and lands in Alice's wallet. The bank boundary runs negative, recording how much came in.
// WALLET_TOPUP
// Event: Alice funds her wallet; cash enters via the platform's bank rail
send [USD/2 5000000] (
source = @platform:banks:chase:main allowing unbounded overdraft
destination = @users:alice:wallet
)set_tx_meta("event_type", "wallet_topup")
set_tx_meta("topup_id", "tpu001")
Make sure you model real cash entering and leaving through named boundary accounts (never an infinite source), tag every transaction with an event_type and a business id, keep one account per owner across all assets, and write the asset scale on every amount.
Reconciliation rules can only run against a uniform data model, so the job before matching is to ingest raw data from every provider and normalize it into a single consistent shape.
Ingest raw data in its original format, normalize it into a canonical model where every transaction, fee, refund, and chargeback looks the same regardless of origin, then reconcile it against the ledger.
Ensure you store raw provider data in its original format before transformation, so schema changes stay localized to the affected adapter, and you keep an immutable record of what arrived.
Standardize currencies, timestamps, reference fields, and payout structures across every file. Adding a new payment provider should mean building a single connector, while the core reconciliation engine remains untouched. Model each payment as a state machine.
Reconciliation is the process of confirming that every state transition that should have occurred did so, in the right order and with the correct amounts.
Reconciliation rules should encode how each rail actually settles, with matching dimensions living in configuration rather than hardcoded logic.
Put IDs, reference fields, amounts, currencies, fees, batches, and time tolerances in configuration so a change to settlement timing or a fee structure does not require a code deploy.
For a multi-provider product, the reconciliation layer needs per-rail tolerance configuration and independent aging logic to avoid false exceptions when a slow rail is operating within its expected window.
Your rules have to handle every match cardinality. A single bank deposit may cover:
A transaction authorized today may not settle immediately, and a chargeback filed today may reference an older payment, so rules need to distinguish normal timing delays from real errors. Score matches by confidence: high-confidence auto-approves, medium-confidence queues for review, and low-confidence escalates immediately.
Centralizing reconciliation rules on top of a unified ledger and normalized rail data is what makes a daily regulatory cadence achievable.
Automated reconciliation runs as a recurring pipeline, so a practical rollout starts in phases:
Throughout, detect duplicate files, avoid reprocessing and cover every transaction type, including states where money never moves.
Remember that exception handling is where the design earns its keep.
An exception queue routes issues to the right person, categorizing them by type and risk, with the context needed to resolve them. Auto-resolve small variances below a configured threshold and escalate high-value discrepancies with clear ownership by category.
Fail-safe pipelines raise alerts when thresholds are exceeded, or mismatches persist beyond expected windows, without triggering any financial side effects until the situation is understood. Provider outages, regulatory freezes, and business-driven adjustments always need supervisor review before corrections are posted.
Automated reconciliation stops the drift of internal records saying one thing, the bank another, and the PSP a third. It does so by continuously reconciling every movement against an immutable source of truth, rather than trusting that the numbers will agree at month-end.
That only works when four pieces operate as a system:
Of the four, the ledger is where to start, because the other three reconcile against it. Whether you build or use a programmable ledger, once you get that foundation right first, then layer normalized connectivity, rules, and exception handling on top, and reconcile every rail to a single record that balances by construction.
This is how Formance Ledger and Formance Reconciliation work together: the Ledger holds the canonical, bi-temporal record of every money movement, and Reconciliation continuously synchronizes those balances against the accounts you hold at your financial partners, flagging drift the moment it appears.