System ownership
For each entity—client, account, payment, trading account, partner—define the authoritative source and permitted writers.
Integration services
Use service boundaries for platform-, KYC- and payment-provider-specific logic where this reduces coupling.
Authentication
Keep privileged credentials server-side and use least-privilege scopes and controlled secret rotation.
Events and APIs
Choose synchronous APIs for immediate request-response workflows and events/queues where asynchronous processing is appropriate.
Idempotency
Make retried operations safe and correlate requests across systems.
Reconciliation
Schedule checks for missed events and data drift, with an operational exception queue.
Observability
Use structured logs, metrics and tracing/correlation identifiers for critical workflows.