Building a SAMA-Compliant Payment System: Architecture Decisions That Matter بناء نظام دفع متوافق مع ساما: القرارات المعمارية المهمة

The Challenge of SAMA Compliance

Building a payment system in Saudi Arabia requires strict adherence to SAMA (Saudi Central Bank) regulations. This isn't just about checking compliance boxes; it's about architecting a system that fundamentally prevents financial anomalies.

1. Immutable Ledger Design

Traditional CRUD operations are a liability in financial systems. We implemented an Event Sourced Ledger where every financial mutation is an immutable event. This ensures a cryptographically verifiable audit trail.

• No UPDATE or DELETE statements on financial records.
• Double-entry accounting patterns enforced at the database schema level.
• Point-in-time state reconstruction for SAMA audits.

2. Webhook Reconciliation

Payment gateways (like Moyasar or HyperPay) can experience timeouts. Relying solely on synchronous API responses leads to split-brain scenarios. We use a background worker queue strictly dedicated to webhook reconciliation, ensuring eventual consistency without blocking the main thread.

Conclusion

Compliance is a byproduct of good architecture. By designing for zero-trust and immutability, SAMA compliance becomes an automated guarantee rather than a manual checklist.