A Functional Overview
In a digital-first world where commerce spans across physical and online channels, building a highly available, scalable, and resilient payment gateway is mission-critical. This case study examines the architecture, components, and operational workflows of a contemporary omnichannel payment gateway that facilitates both Point-of-Sale (PoS) and Unified Payments Interface (UPI) transactions, while ensuring high uptime and security.
A payment gateway is a technology platform that facilitates payment transactions between customers, merchants, and financial institutions. It enables merchants to accept various payment methods like cards, bank transfers, mobile wallets, and UPI.
The gateway:
Modern commerce requires a payment infrastructure that can handle multi-channel payments, support various payment methods, ensure regulatory compliance, and provide exceptional reliability at massive scale.
99.99% uptime with multi-region failover and circuit breakers
Graceful degradation with retry mechanisms and fallback routing
Horizontal scaling with auto-scaling and load balancing
PCI-DSS Level 1 compliance with tokenization and encryption
Multi-channel payment initiation
CDN, Load Balancers, API Gateway
Microservices, Orchestration, Business Logic
Banking APIs, Card Networks, UPI PSPs
The payment gateway consists of six interconnected services, each responsible for specific aspects of payment processing, working together to ensure secure, reliable transactions.
Entry point for all payment requests
Secure access control for all requests
Real-time fraud detection and prevention
Smart routing and fallback management
Secure storage and management of payment data
UPI-specific payment processing
Let's examine how the system handles real-world scenarios, demonstrating resilience, intelligent routing, and seamless user experience across different payment methods.
Demonstrating system resilience and intelligent routing
Demonstrating real-time UPI integration and callback handling
Seamless handling of PoS, web, and mobile transactions
Dynamic routing with automatic failover capabilities
ML-powered risk assessment and prevention
Mission-critical availability with minimal downtime
Optimal performance under high-load conditions
Enterprise-grade security and regulatory compliance
This functional overview covered the business context, core components, and real-world transaction flows. Next, we'll explore the technical architecture, AWS infrastructure, and detailed implementation patterns.
A customer taps their Visa debit card on a PoS terminal at a retail store in London. The transaction amount is £25. The primary acquirer (e.g., FIS) is experiencing timeouts, so the transaction is routed to a fallback acquirer (e.g., Barclays) and successfully authorized.
🟢 PoS Terminal
🟡 API Gateway / Edge Layer
🟠 Gateway Orchestrator
🟣 Tokenization Service
🔵 Fraud/Risk Engine
🟤 Transaction Router (Fallback Logic)
⚪ Orchestrator Finalization
🟠 Notification & Events
payment.authorized| Pattern | Description |
|---|---|
| ISO 8583 | Used by legacy acquirers (FIS, First Data, Barclays). Requires message packing/unpacking, MTIs, DEs. |
| REST/gRPC API | Used by modern PSPs (Adyen, Stripe, Elavon). Faster integration, JSON/gRPC payloads. |
| File-based Settlement | Batch files uploaded via SFTP for settlement (legacy but still common). |
| Message Queue Integration | Some PSPs use MQ (IBM MQ, Rabbit) for async workflows. |
MTI0100 (request), 0110 (response)DE2PANDE3Processing CodeDE4AmountDE7Date/TimeDE11STAN (System Trace Audit Number)DE39Response CodeEnsure low latency, global scale, and zero-downtime failover.
Primary for UK/Europe
Backup or active-active
| Area | Strategy |
|---|---|
| EKS | Multi-AZ nodes, zonal balancing, HPA + VPA |
| DB | Aurora Global DB (failover in <60s), write forwarding |
| Secrets | Replicated with AWS Secrets Manager |
| Kafka | MSK multi-AZ with geo-replication (optional) |
| API Gateway | Regional + global acceleration with health-check-based failover |
Point of Sale (PoS) Terminal
The customer taps their debit card
API Layer
Validates and authenticates requests
Orchestrator
Coordinates tokenisation and fraud checks
Router
Selects the acquirer. If primary fails, use fallback
Acquirer
Approves or declines
Orchestrator
Returns response to PoS
Post-processing
Event published for settlement, audit, etc.
Customer Action
Selects UPI, enters VPA or scans QR
API Layer
Forwards to UPI orchestrator
UPI Orchestrator
Initiates UPI intent using PSP
NPCI/Bank PSP
Customer approves in their UPI app
Callback
PSP confirms success to the gateway
Orchestrator
Finalises and returns authorisation
Post-processing
Transaction logged, notified
Customer selects "Pay by UPI" on a mobile PoS or eCommerce site. They enter their UPI ID (e.g., user@okicici) or scan a QR code. UPI intent is triggered, and they approve the payment in their UPI app (e.g., GPay or PhonePe).
🟢 Frontend / PoS
🟡 Edge/API Gateway
🟠 Gateway Orchestrator
🔵 UPI Orchestrator
🟣 NPCI/Bank PSP
🟤 Callback / Polling
POST /upi/status| Component | Function |
|---|---|
| Payment Type Resolver | Classifies card, UPI, wallet, etc., and routes internally. |
| UPI Orchestrator | Handles UPI-specific APIs, QR generation, callback parsing. |
| UPI PSP Integrations | REST APIs to Razorpay, Cashfree, PayTM, PineLabs (NPCI certified providers). |
| Callback Handler | Secure endpoint to receive status updates from PSPs. |
| Risk Engine Hooks | Optional velocity/duplicate checks on UPI ID. |
| Layer | Enhancement |
|---|---|
| API Contract | New routes: /upi/initiate, /upi/status |
| Risk Layer | Rules for frequency on UPI ID, UPI handle blacklist, geo-fraud detection |
| Notification | Send webhook/email after UPI success |
| Event Bus | Add upi.payment.success, upi.payment.failed Kafka topics |
| Audit | Store payer VPA, PSP ID, txn ref, timestamp, amount, response code |
| Challenge | Solution |
|---|---|
| NPCI/PSPs are India-region only | UPI orchestrator deployed in ap-south-1 (Mumbai) or edge proxied |
| Callback locality issues | Edge-distributed API Gateway routes callback to correct region |
| Latency for PoS terminals abroad | Use regional frontends → route only UPI flows to India-based backends |
| Resiliency | Multi-AZ EKS in Mumbai + health-based PSP fallback (Razorpay → PayTM) |
Built with PCI DSS Level 1 compliance, end-to-end encryption, and comprehensive audit trails.
Visa, MasterCard, RuPay
PhonePe, GPay, Paytm
All major banks
Digital wallets
A modern payment gateway must be secure, intelligent, and globally scalable, with support for traditional cards and modern methods like UPI. By separating responsibilities into orchestrated services and using cloud-native, fault-tolerant infrastructure, businesses can process payments reliably while innovating on features, fraud detection, and user experience.
Such a platform doesn't just move money, it powers trust in the digital economy.