A timeout is an unknown, not a failure
A client can lose a response after a provider has accepted a payment. Retrying without a stable request identity may duplicate an operation. Model pending and unknown states explicitly, and define how status is recovered from an authoritative provider record. Do not let a browser refresh decide the financial meaning of a transaction.
Make idempotency a business rule
An idempotency key needs a defined scope, lifetime and relationship to the requested operation. Decide what happens when the same key arrives with different data. Store enough information to return a consistent result. Include duplicate callbacks and out-of-order events in tests, because queues and network retries can deliver the same event more than once.
Reconciliation is part of the product
Internal records and provider settlements will not always agree immediately. Design a reconciliation process with matched records, explainable differences and a queue for human review. Preserve audit evidence without collecting unnecessary sensitive data. A dashboard that says everything is healthy is less useful than a workflow that lets an operator resolve a specific discrepancy.
Separate architecture from authorization
A sound design does not grant access to a bank, payment network or regulated activity. Integrations require the appropriate agreements, sandbox access and provider documentation. Compliance questions belong with qualified specialists. Engineering can support evidence collection and readiness, while certification and licensing follow their own authorized processes.