The platform
Every design decision answers one question: can we prove this to a regulator, an auditor and a customer? The result is a platform where going live is a configuration change — not an architecture change.
Two-stack architecture
The platform is split into two independently deployable stacks with a deliberate wall between them. The customer-facing stack holds all personal data, collects local currency and runs every compliance control. The execution stack — the only place that ever touches the international exchange — sees nothing but opaque references and USD amounts.
The boundary is not a policy. It is enforced in the schema and in tests: the execution side has no columns that could hold a name, phone or ID, and the intent receiver rejects any payload that looks like personal data.
Core capabilities
Pluggable identity verification (local or global vendors) with age and residency checks at onboarding — behind a single provider interface.
Screening, risk scoring and velocity monitoring with escalation hooks, producing the records a compliance officer needs on demand.
Rate-locked LKR↔USD quotes that are single-use and time-boxed — the customer transacts at exactly the rate they were shown.
Double-checked, decimal-exact accounting of balances, reservations, positions and payouts. No floating-point money, ever.
Customer intents are aggregated into an omnibus order and fills are distributed pro-rata with largest-remainder rounding — no invented or lost contracts.
Resolutions and payouts are reconciled back to every position automatically, with breaks surfaced rather than absorbed.
Nets a whole period into one instruction, generates a regulator-ready export, and waits for human authorisation. It never auto-executes.
A hash-chained, append-only record with a verification routine that detects any tampering across the entire history.
End to end
Money is Decimal from the first cent to the last. The journey below is covered end-to-end by automated tests before any release ships.
The customer registers; identity, age and sanctions checks run and are recorded in the audit chain.
A single-use quote fixes the LKR↔USD rate for five minutes; the deposit settles at exactly that rate or not at all.
The wager becomes a signed order intent — carrying only an opaque reference — that crosses the boundary to the execution stack.
Intents in the window are pooled into one order to the regulated exchange; fills return for allocation.
Filled contracts are distributed so the sum of allocations equals the fill precisely — no rounding leakage.
When the event resolves, payouts flow back to each position and reconcile against the ledger.
The period nets to one human-approved instruction with a regulator-ready export — and the whole chain verifies.
Built on a modern, boring-on-purpose stack