System design deep dive: clearing house architecture

A clearing house processes millions of instructions every day, often 10 to 50 million in a large domestic system, with peak rates of 5,000 to 10,000 instructions per second. Instructions arrive through secure file transfers and real time APIs, are validated on receipt, and are stored in a high throughput intake database. The intake layer is designed to accept a burst without blocking, so a bank that sends a file of 500,000 instructions at 9 in the morning does not slow down the banks sending smaller files at the same time. Each instruction is given a unique clearing reference, a timestamp, and a status, and it is acknowledged to the sender within seconds so the sending bank can confirm receipt. Batch clearing and real time clearing serve different needs, and most clearing houses run both. Batch clearing groups instructions into cycles, typically four to six cycles per day, and processes each cycle as a single job, which is efficient for high volume low value payments such as salaries and direct debits. Real time clearing processes each instruction as it arrives, with a target of under five seconds from receipt to confirmation, which suits urgent and high value payments. The batch engine is tuned for throughput, processing up to one million instructions per cycle in under 30 minutes, while the real time engine is tuned for latency, with in memory processing and minimal database writes on the critical path. The netting engine calculates what each participant owes or is owed after offsetting payments in both directions. For each participant and each settlement cycle, it sums all outgoing payments and all incoming payments, and the difference is the net position. A bank that sent 800 million and received 750 million in a cycle has a net debit of 50 million, and only that net amount moves at settlement, not the full 1.55 billion of gross flow. This reduces the liquidity each bank needs by 90 percent or more in a typical cycle. The engine runs in parallel across participants, locks the position once calculated, and produces a net position report that each bank can verify before settlement begins. The settlement file is the output of netting, and it is the instruction that moves money at the central bank. It lists every participant, its net debit or credit, the settlement account, and the total for the cycle, and it is signed and sent to the central bank's real time gross settlement system. Settlement usually happens once or twice per day for batch cycles, and continuously for real time systems. The file is generated only after all participants have confirmed their net positions or the confirmation deadline has passed, and it is checked for balance, so total debits must equal total credits to the cent. Any imbalance stops the file and triggers an immediate investigation. When a participant fails to settle, the clearing house follows a pre agreed default procedure. First it checks whether the shortfall is a timing issue and grants a short grace period, often 30 to 60 minutes, for the bank to fund its account. If the funds do not arrive, the clearing house may use the default fund, a pool of collateral contributed by all participants, to cover the shortfall so other banks still settle on time. The defaulting bank is then suspended from new cycles until it restores its position, and its unsettled instructions are held or returned according to the scheme rules. This design contains the failure to one participant instead of letting it cascade across the whole system.