Crypto payroll platform

Context

A licensed crypto payments company needed to operate crypto-settled payroll across multiple client companies and currencies, with controls a spreadsheet process can never provide: no single person able to move funds alone, every batch verifiably funded before disbursement, every failure recoverable without double payment, and every action attributable after the fact.

This case is published with the client's identity withheld.

Challenge

Crypto payroll is a fund-moving system, so the hard requirements were control requirements:

• No single person could be allowed to create, approve and disburse a payment batch — segregation of duties had to be enforced by the system, not by policy.
• Every batch had to be verifiably funded before disbursement, with over- and under-payment detected automatically.
• Payment failures and retries could never result in a double payment, even across crashes.
• Salary data could not leave the platform — payslip generation had to happen entirely in-process.
• Eleven currencies meant exchange rates had to lock the moment the payer commits, with money arithmetic exact to the cent.

What we did

Development

• An explicit lifecycle, not a status field — every batch moves through a strict state machine (draft, director approval, funding, disbursement, paid, plus explicit failure and refund branches) with legal transitions enforced in the database. Each role sees a task queue of exactly its pending work.
• Control enforced below the application — maker-checker separation, single-active-owner constraints and money arithmetic live in the database as constraints and atomic procedures: integer cents, no floating point, no application-level trust. Every fund-moving action additionally requires a passkey (WebAuthn) step-up.
• Funding that proves itself — each batch gets a dedicated deposit reference; confirmation is event-driven with scheduled verification as a backstop, and balances are independently re-verified before any state changes. Over- and under-funding route to structured resolution, including refunds with their own approval gates.
• Failure as a designed path — bounded retries guarded against double-spend, recovery sweeps for executions stranded by crashes, a manual-intervention queue for anything that exhausts retries, and a daily six-dimension reconciliation scan that reports drift before it becomes a discrepancy.
• In-house payslips — generated in-process with signed, expiring links, so salary data never touches a third-party service.
• Bulk employee import with per-row validation, recurring allowances and deductions with snapshot semantics, and a trilingual UI (English, 中文, Bahasa Indonesia).

Outcome

• Payment batches move through enforced approval gates that no role can bypass.
• Funding reconciles automatically per batch, with mismatches detected and routed to resolution.
• Failures resolve through bounded retries, recovery sweeps and escalation — never a double payment.
• Payslips generate in-house with signed expiring links, so salary data never leaves the platform.
• Every action is attributable through audit trails and role-aware dashboards.
• Validated by 100+ automated end-to-end test suites and staged acceptance deployments.