【BIS】FuSSE项目：探索灵活、可扩展和安全的结算引擎

ProjectFuSSE

(FullyScalableSettlementEngine)

Exploringthescalable,flexibleandsecuredesignofmodernsettlementengines

January2026

ProjectFuSSE:FullyScalableSettlementEngine

3

Publicationdate:January2026.

©BankforInternationalSettlements2026.Allrightsreserved.Briefexcerptsmaybereproducedortranslatedprovidedthesourceisstated.

TheopinionsexpressedinthisworkarethoseoftheauthorsanddonotnecessarilyreflecttheviewsoftheInter-AmericanDevelopmentBank,itsBoardofDirectorsorthecountriestheyrepresent.

ProjectFuSSE:FullyScalableSettlementEngine

4

Contents

Acronymsandabbreviations5

Executivesummary7

1.Introduction9

2.ProjectFuSSE11

2.1Overview11

2.2Technicalapproach11

2.3Monolithicvsmicroservicesarchitectures12

2.4Architectureandcomponents14

2.5Microservicesdesignandworkflow16

2.6Cryptography17

2.7Monitoring19

3.Resultsanddiscussion20

3.1Testresults20

3.2Discussion20

4.Conclusion24

References25

AppendixA:Underlyingtechnologies27

AppendixB:Testingandresults30

AppendixC:Applicability32

AppendixD:Securitylearningsfromthecryptographicmicroservices34

Contributors36

ProjectFuSSE:FullyScalableSettlementEngine

5

Acronymsandabbreviations

AE

Advancedeconomy

AI

Artificialintelligence

AKS

AzureKubernetesService

API

Applicationprogramminginterface

CPMI

BISCommitteeonPaymentsandMarketInfrastructures

CPU

Centralprocessingunit

DLT

Distributedledgertechnology

EMDE

Emergingmarketanddevelopingeconomy

FMI

Financialmarketinfrastructure

FuSSE

FullyScalableSettlementEngine

HSM

Hardwaresecuritymodule

IDB

Inter-AmericanDevelopmentBank

IoT

InternetofThings

IPS

Instantpaymentsystem

JSON

JavaScriptObjectNotation

MVP

MinimumViableProduct

NIST

NationalInstituteofStandardsandTechnology

NP

Nondeterministicpolynomial

PFMI

Principlesforfinancialmarketinfrastructures

PKI

Publickeyinfrastructure

PoC

Proofofconcept

ProjectFuSSE:FullyScalableSettlementEngine

6

PQC

Postquantumcryptography

RAM

Random-accessmemory

RTGS

Real-TimeGrossSettlement

TARGET

Trans-EuropeanAutomatedReal-timeGrosssettlementExpressTransfer

TIPS

TARGETInstantPaymentSettlement

TPS

Transactionspersecond

UPI

UnifiedPaymentsInterface

ProjectFuSSE:FullyScalableSettlementEngine

7

Executivesummary

Financialmarketinfrastructures(FMIs)arethebackboneofthefinancialsystemandmustremainsecure,resilientandadaptableastechnologiesandmarketsevolve.Thecontinuedglobalriseofdigitalpayments–acceleratedbyrapidinnovationinareassuchastheInternetofThings(IoT),artificialintelligence(AI)-drivencommerceandexpandingfintechparticipation–placesincreasingdemandsonexistinginfrastructures.Thesedevelopmentspromiseefficiencyandinclusionbutalsointroducegreatercomplexity,scalabilitychallengesandnewformsofoperationalandcyberrisk.

Tomeetthesechallenges,thenextgenerationofFMIswillneedtoembodythreereinforcingdesignqualities:flexibility,toadapttoinnovationandregulatorychange;scalability,toaccommodatesustainedgrowthandstressconditions;andsecurity,toensurequantumreadinessandcryptographicagility

1

inanevolvingthreatenvironment.

ProjectFuSSE(FullyScalableSettlementEngine)exploredtheseissuesthroughaproofofconcept(PoC)thatexaminedhowamodular,microservices-based

2

architecturecouldsupportthedesignofflexible,scalableandsecuresettlementsystems.Theprojectshowedthatmicroservicescouldenablesystemstoprocesshightransactionvolumesefficiently,achieving10,000transactionspersecond(TPS)

3

withoutlinearincreasesincomputingpower.Thisarchitectureallowsforindividualservices,includingthosehandlingcryptographicoperations,toscaleindependently,improvingperformanceandresilience.Itcouldalsofacilitatecryptographicagility,enablingadaptationtoemergingpost-quantumcryptography(PQC)standardswithoutlargesystemredesigns.

Atthesametime,theprojecthighlightedtrade-offs.Microservicesarchitecturesintroducenewlayersofoperationalcomplexity,requirecarefulorchestrationandexpandthepotentialattacksurface.PQCalgorithmsaddcomputationaloverhead,whichcouldmultiplyacrossserviceboundaries,buttheseimpactscouldbemitigatedthroughtargetedscalingandloadmanagement.

Theprojectalsounderscoredthatoperationalagility–theabilityofinstitutionstoadaptgovernance,certificationandincident-responseframeworksinparallelwithtechnologicalchange–isasimportantascryptographicagilityformaintainingtrustandcontinuity.

1Cryptographicagilitymeansdesigningasysteminsuchawaysoencryptionandsignaturemethodscanbeswappedorupgradedmoreeasily(forexample,ifanalgorithmbecomesunsafe),withoutneedingtorebuildthewholesystem.

2Microservicesareindependentservices(iebuildingblocks),eachresponsibleforaspecificfunctionandabletooperate,beupdated,andbescaledseparatelyfromtheothers.

3FMIgradelevelperformancetypicallyalsomeansmeasuringdelaysandhowquicklytransactionsbecomefinalduringheavyload.Theseresultsarefromsimulationsandwillvarybydeploymentandconfiguration.

ProjectFuSSE:FullyScalableSettlementEngine

8

Forsomeadvancedeconomiesalreadyrunninghigh-capacityinstantpaymentsystems(IPS),ProjectFuSSEshowedapproachestomodularisingthesettlementcore-breakingitintodistinctcomponents-andembeddingquantum-resilientcryptographyandhowthiscouldenablecryptographicandoperationalagility.

Forsomesmalleroremerging-marketjurisdictionsthatmaybeoperatinglegacyarchitecturesandconsideringupgradingtheirsystemsorplanningtointroducereal-timesettlement,theprojectdemonstratesamodular,opensourceapproachthatcouldscalewithoutrequiringone-for-one(ielinear)increasesininfrastructureinvestment.

AlthoughProjectFuSSEisaPoC,itsfindingsprovidepracticalinsightsforcentralbanksandFMIoperators.Itspurposeistoexploredesignprinciples–nottoprescribeoperationalmodelsorpolicychoices–andassuchitcouldbedeployedbyinterestedpartiesforexperimentationandlearning.

Theresultsshouldbeinterpretedastechnicalfindingsillustratingarchitecturalfeasibilityundercontrolledtestconditions,ratherthanaperformancebenchmarkorimplementationguide.Theprojectdoesnotdeliveraminimumviableproduct(MVP)orproduction-readycomponentsofasystem,nordoesitmeetoperational,securityorregulatoryrequirementsundertheprinciplesforfinancialmarketinfrastructures(PFMI).Thefindingsoftheprojectcouldhelpsystemdesignersconsiderimportantaspectsofmodernapproachestosystemscalingandquantumagility,bothessentialtothefutureofFMIs.

4

ProjectFuSSEwasmadepossibleinpartnershipwithandthroughresourcecontributionsfromtheInter-AmericanDevelopmentBank(IDB),theCentralBankofChileandtheBankofCanada.

4Theprojectdoesnot:(i)specifyortestaparticularpaymentscheme,costmodelorgovernancearrangement;(ii)recommendanyspecificdeploymentmodel(theuseofcloudinfrastructurewasillustrativeanddeployment-agnostic);(iii)selectorendorseaparticularPQCalgorithmormigrationpath;or(iv)providefullfunctionalcoverageofarealtimegrosssettlement(RTGS)orIPS(includingbutnotlimitedtoliquiditymanagement,gridlockresolution,participantaccess,clearingornettingvariations).

ProjectFuSSE:FullyScalableSettlementEngine

9

1.Introduction

Financialmarketinfrastructures(FMIs)arethebackboneofthefinancialsystemandassuchmustremainsecure,resilientandadaptableovermanyyears.

Acrosstheworld,thevolumeofdigitalpaymentscontinuestoriseeachyear,withespeciallystronggrowthinemergingmarketeconomies(seeGraph1).InSoutheastAsia,digitalretailpaymentvolumeshaveexpandedrapidlyforoveradecade,whileinLatinAmericaadoptionacceleratedsharplyduringtheCovid-19pandemic.Lookingahead,transactionvolumesareexpectedtogrowevenmorerapidly,

5

drivennotonlybythesetrendsbutalsobynewdevelopmentssuchasInternetofThings(IoT)-basedpaymentsandemergingformsofartificialintelligence(AI)-driven,agenticcommerce.

CashlesspaymentvolumesGraph1

Note:Numberofcashlesstransactions(credittransfers,directdebits,cardande-moneypaymentsandcheques)percapitaforemergingmarketsanddevelopingeconomies(EMDEs)andadvancedeconomies(AEs).

Source:CPMI,RedBookstatistics.

Whiletheseinnovationspromisegreaterefficiencyandconvenience,theyalsocreatescalabilitychallengesfortraditionallydesignedFMIs.Furthermore,thebreadthand

5SeeCapGeminiResearchInstitute(2025).Non-cashtransactionsstoodatapproximately1.4trillionin2023andareforecastedtomorethandoubleto3.5trillionin2029.

ProjectFuSSE:FullyScalableSettlementEngine

10

diversityofparticipantsinFMIsislikelytogrowasnewkindsofinstitutions,suchasfintechs,gainaccess.Thisexpansionincreasesboththeavailabilityofanddemandfornewproductsandservices,manybuiltonemergingtechnologies.

Whilethisfostersinnovation,italsoaddscomplexityandheightensthechallengesofdesigninginfrastructureswithsufficientflexibility.

IncreasesinbothvolumeandparticipationcouldgrowharderfortraditionallydesignedFMIsystemstomanage.

6

Thearchitectureanddesignofnext-generationFMIscouldconsideratleastthreereinforcingqualities:

•flexibility,toevolvestructurallyandadapttonewtechnologies,regulationsandmarketinnovationswhilemaintainingstability;

•scalability,tohandlelong-termgrowth,highvolumesandsuddensurgesinactivity(withoutsufficientcapacity,stressorgrowthcouldcauseoperationalfailureswithsystemicimpact);

7

and

•security,intheformofquantumreadinessandbothoperationalandcryptographicagility,tosafeguardtrustinthefaceofacomplexandevolvingcyberthreatlandscape.

Together,thesequalitiesenablethearchitectureanddesignofstable,resilientsystemsthatcouldbecapableofsupportingthedynamicneedsofthefuture.

Whiletraditionalmeasuresofpaymentsystemperformanceemphasisecost,speedandreliability,thesedescribeoutcomesasobservedbyusersatagivenpointintime.Bycontrast,ProjectFuSSEfocusesonthearchitecturalqualitiesthatsustainthoseoutcomesastechnologies,marketconditionsandrisksevolve.

Flexibility,scalabilityandsecurityfunctionasenablersofthesetraditionalobjectives:flexibilitysupportslong-termcostefficiencyandadaptabilitytopolicyortechnologicalchange;scalabilitymaintainshighthroughputandoperationalreliabilityasvolumesexpand,

8

andsecurity,includingquantumreadiness,safeguardstrustandcontinuity.

ProjectFuSSEthereforedoesnotassumethatcost,speedandreliabilityarealreadyachieved,butratherseekstoexplorehowtheycouldbemaintainedandimprovedoversuccessiveiterationsofsystemdesign.

6SeeDarbhaetal(2025),ECB(2023)andCPMI(2022).

7SeeCPSS-IOSCO(2012).

8Scalabilityalsomaintainscostsproportionaltouptake.Ascalablesystemreducestherisksofbuildingunusedcapacity,avoidinghighcapitalcost.

ProjectFuSSE:FullyScalableSettlementEngine

11

2.ProjectFuSSE

2.1Overview

ProjectFuSSE(FullyScalableSettlementEngine)exploreshowsettlementenginescouldbedesignedfromtheoutsetwiththreereinforcingqualities:(i)theflexibilitytoevolveasstandardsmature,(ii)thescalabilitytohandleexponentialgrowthwithoutproportionalinfrastructurecosts,and(iii)thesecuritytoremainresilientinapost-quantumthreatenvironment.

Whileseveralinstantpaymentsystems(IPS)havesuccessfullyadoptedmicroservicesarchitectures,forexampletheUnifiedPaymentsInterface(UPI)inIndia,theTARGETInstantPaymentSettlement(TIPS)inEuropeandPixinBrazil,optimisingforscalabilityandresilience,ProjectFuSSEplacesequalemphasisonforward-lookingsecurityrequirements,particularlythetransitiontoPQC.

ProjectFuSSEdiffersfromdistributedledgertechnology(DLT)-basedsettlementapproaches.WhileDLTsystemsofferbenefitssuchasatomicsettlementandcryptographicverificationacrossmultipleparticipants,theyoftenfacethroughputconstraintsduetoconsensusmechanismsandsynchronisationrequirements.ProjectFuSSEshowsthatotherapproachescouldachievecomparableorgreatertransactionthroughput,whileincorporatingquantum-resistantcryptography,whenusingcloud-nativedesignpatternsthatenableindependentscalingofsecurity-intensiveoperations.

9

2.2Technicalapproach

ThePoCwasdesignedasasettlementenginearchitectureratherthanasafullpaymentscheme.Itsimulatesthecorefunctionsthatunderpinreal-timesettlementincentralbankmoney,consistentwithRTGSprinciples,whileremainingagnostictothepaymentlayerorusecasethatconnectstoit.Thearchitecturecouldthereforesupportnext-generationretailIPS,wholesaleinterbanksettlementorotherFMIcomponentsrequiringhighthroughputanddeterministicfinality.

Thesystemwasdeployedinacloud-basedenvironmenttodemonstrateelasticscalingandresilienceusingwidelyavailableopensourcetools(egKubernetes,Kafka,Redis),illustratingthatcloud-nativeprinciples,containerisation,statelessprocessingandhorizontalscalingcouldbeappliedineitherprivate,hybridoron-premiseinfrastructures.

10

9Referencestoalternativesettlementdesignsareintendedtoprovidecontextratherthanahead-to-headevaluation.Anycomparativeassessmentwouldneedtoaligntrustassumptions,finalitysemanticsandthreatmodelsbeforedrawingconclusionsonscalabilityorsecurity.

10ItshouldbenotedthatthisdoesnotimplythatFMIsshouldoperateinthepubliccloud.

ProjectFuSSE:FullyScalableSettlementEngine

12

Thearchitectureintroducedseveralnovelfeaturesunderthethemesofflexibilityandscalability.FuSSEemploysamicroservices-based

11

designinwhicheachfunctionalcomponentoperatesasastatelessservicethatcouldbedeployed,updatedorreplacedindependently.Thismodularityenablescontinuoussystemevolutionwithoutrequiringfull-systemredeployment.Thearchitecturesupportshorizontalscalability,makingitpossibletoincreaseoverallcapacitybyrunningadditionalserviceinstancesratherthanupgradinghardware,achievingsub-lineargrowthincomputingresourcesastransactionvolumesrise.

Thesystemalsoimplementsadecentralisedcommunicationpattern,inwhichtransactionmessagescarrytheirownroutinginstructions(“routingslips”).Decentralisedroutingimprovesmodularitybutrequiresstrongcontrolsforrouteintegrity,versioningandauditabilityinordertoensurepredictableprocessingandsupervisorytransparency.

Testingvalidatedthatsuchanarchitecturecouldhandlelargeandrapidincreasesintransactionvolumeswhilemaintainingfastsettlementandenablingnewfunctionstobeappliedwithminimaldisruption.

TheprojectalsotestedtheapplicationofPQC

12

toexplorethepotentialofamicroservicesapproachinsupportingcryptographicagility,aswellastounderstandtheimpactofemergingsecuritystandardsonscalabilityandflexibility.

2.3Monolithicvsmicroservicesarchitectures

Traditionalfinancialsystemsoftenrelyonmonolithicarchitectures,inwhichapplicationlogic,dataaccessandinterfacesarebundledintoasingledeployableunit.Whilethissimplifiesdeploymentandensuresconsistency,itlimitsscalabilityandflexibilityassystemsgrow.

13

Evenminorupdatesrequireredeploymentoftheentiresystem,creatingbrittleness,slowinginnovationandexposingsinglepointsoffailure.Overtime,sucharchitecturesbecomebottlenecks,particularlyinfinancialinfrastructuresfacinghightransactionvolumes,frequentregulatorychangeandevolvingcyberrisks.

14

Incontrast,microservicesarchitecturesbreakfunctionsandsoftwareintosmall,independentpieces(orservices)thatareeachdesignedforaspecificfunctionandthatcommunicatevialightweightprotocols.Eachservicecouldbescaled,updated

11Amicroservicesarchitectureisawayofdesigningsoftwareinwhichapplicationsarebrokendownintosmall,independentservicesthateachhandleaspecificfunction.TheseservicescommunicatethroughApplicationprogramminginterface(APIs),makingsystemsmorescalable,moreflexibleandeasiertomaintain.

12PQCisimportantbecausemostoftoday’scryptographyreliesonmathematicalproblemsthatareextremelyhardforclassicalcomputerstosolvebutthatcouldbebrokenbyfuturequantumcomputers.Thiscreatesariskofthe“harvestnow,decryptlater”strategy,inwhichcriminalsstoresensitiveinformation,suchasfinancialdata,withtheintentionofunlockingitoncequantumtechnologiesmature.

13Otherdrawbacksofmonolithicarchitecturesmayincludehighcomplexityandcoupling,“all-or-nothing”deployment,technologylock-inandpotentialreliabilityrisks,whileotheradvantagesmayincludeeasiertestinganddebugging.

14SeeTapiaetal(2020).

ProjectFuSSE:FullyScalableSettlementEngine

13

andoperatedindependently,enablinggreaterflexibilityandfasteradaptationtonewtechnologiesorregulatoryrequirements.Thismodularityalsoallowsforincrementaladoptionofenhancedsecuritystandards,includingPQC.

Monolithicvsmicroservicesarchitecture

Graph2

Note:Monolithic(left-handside)vsmicroservices-based(right-handside)architectures.

However,theapproachaddscomplexity:orchestration,

15

dataconsistencyandinter-servicesecurity

16

mustbecarefullymanaged,andtheattacksurfaceexpandsasthenumberofinteractionsgrows.Infintechandpayments,cloud-nativeandevent-drivenmicroservicesareincreasinglyseenasawaytobalancescalability,securityandflexibilityinacomposableframework.

17

,

18

Severalpaymentsystemsdemonstratehowmicroservicesarchitecturescouldsupporthighscalability,flexibilityandresilienceinreal-timeretailpayments.

InIndia,UPIwaslaunchedin2016withamicroservicesarchitecture.UPIhasgrownrapidlyandnowsettlesaround18billionpaymentseverymonthacrossmorethan

Instantpaymentsystems(IPS)andmicroservicesarchitectures

15Orchestrationmanagesandsynchronisesautomatedtasksacrossmultiplesystems,combiningthemintocomprehensiveworkflowssothatindividualtasksoperatetogethertoachieveaspecificgoalorprocess.

16Inter-servicesecurityinmicroservicesensuresthatcommunicationbetweenservicesisauthenticated,authorisedandencryptedtopreventunauthorisedaccessanddatabreaches.

17SeeChalla(2021).

18SeeBattula(2025).

ProjectFuSSE:FullyScalableSettlementEngine

14

675banks.

19

Itsmodulararchitecturehasenabledthesystemtoscaletohighertransactionvolumesandtointegratenewservicesandparticipantsmoreeasily.

InEurope,theTIPSsystem,operatedbytheEurosystem,similarlyleveragesmodularanddistributeddesignfeaturestosupportveryhighthroughput.TIPScanprocessupto2,000paymentspersecondandhasdemonstratedthecapacitytocompleteandfinalisemorethan43milliontransactionsinasingleday.

20

InBrazil,thePixsystemwaslaunchedbytheCentralBankofBrazilin2020.Builttoaccommodatemassiveparticipation,Pixnowhasalmost900millionaccountaliasesregisteredby160millionindividualsandmorethan15millionbusinesses.Inaggregate,usersinitiatesome6.6billiontransactionseverymonth.

21

Theseexampleshighlighthowmicroservicescouldprovidethearchitecturalfoundationforrapidscaling,continuousinnovationandresilienceinthefaceofrisingdigitalpaymentvolumes.TheyillustratethebenefitsofmodulardesignforthefuturedevelopmentofFMIs.

ItisalsoworthnotingthatpaymentschemesandtheFMIsthatsettletheirtransactions(whichmayincludeaproductionsettlementengine)couldhavedifferentgovernancearrangements.

Forexample,inBrazil,thePixschemeisownedbythecentralbank,whichalsooperatesSPI,itspaymentsystem.TIPSfollowsasimilarapproach.InIndia,UPIisrunjointlybyprivatebanksandthecentralbankthroughtheNationalPaymentsCorporationofIndia(NPCI),anorganisationcreatedspecificallyforthispurpose.

22

2.4Architectureandcomponents

TheProjectFuSSEPoCshowedhowamicroservices-basedarchitecturecouldbeusedforasettlementengine.Inthisdesign,alltransaction-relatedtasksareperformedbyasetofindependentmicroservicesthatscalehorizontallytoincreaseoverallsystemcapacity.

Eachserviceisresponsibleforadiscretefunction,suchasdecrypting,processing,validatingorsettlingtransactions,beforeissuinganencryptedconfirmationmessagetoboththesenderandthereceiver.Asupportingsetoftechnologiesmanagestheseservicesandenablessecurecommunicationbetweenthem.

Theserviceisstatelessandthereforereceivesalltheinformationitrequirestocompleteitstaskdirectlywithinthetransactionmessageitself,eliminatingtheneedtoreferencehistoricalrecords.Thisnotonlyenablesrapidprocessingbutalsoallowsmultipleinstancesofthesameservicetooperatesimultaneously,therebysupporting

19SeeNPCI(2025).

20SeeBankofItaly(2020).

21SeeCentralBankofBrazil(2025).

22SeeFrostetal(2024).

ProjectFuSSE:FullyScalableSettlementEngine

15

horizontalscaling.Capacitycouldthusbeincreasedbyrunningmoreserviceinstances,ratherthanbyupgradingtheunderlyinghardware.

Tocoordinateprocessing,ProjectFuSSEtestedadecentralisedcommunicationpattern(knownasaroutingslippattern)

23

inwhichtransactionmessagescarrytheirown“itinerary”-akintoadynamiclistofthestepsrequiredforcompletion(Graph2).

Eachservicereadstheembeddedroutingslip,performsitstask,prunesthecompletedstepandforwardsthemessagetothenextservice.Thisremovestherelianceonacentralisedorchestrator,improvingresilienceandefficiency.Italsomeansthatthefullprocessingpathisvisiblewithineachmessage,whichenhancestraceabilityandauditability.

24

Thiscommunicationpatternprovidesmultiplebenefits.Bydecouplingorchestrationlogicfromservices,thesystemallowsfornewstepstobeaddedorexistingstepstobemodifiedwithoutredesigningacentralcontroller,improvingmodularflexibility.

Commonprocessingunits,suchasforsignatureverification,couldbereusedacrossdifferenttransactionflows,whilethestatelessdesignimprovesfaulttolerancebyallowingretriesorreroutingifacomponentbecomesunavailable.Versionedroutingensuresthateachtransactionfollowsastableprocessevenifthesystemisupdated,whileprocess-agnosticservicescouldbereusedacrossmultipleflows.Together,thesefeaturessimplifymaintenance,supportdiversedeploymentmodelsandenhanceadaptabilitytoevolvingbusinessrequirements.

Additionally,thecommunicationamongmicroservicesfollowsanevent-drivendesignpattern,

25

inwhicheventsexecutedbyonemicroservicearesubscribedtobyothers.Thisminimisesharddependenciesandmakesiteasiertoevolveorreplacecomponents.

Inpractice,eachtransactioneventisaccompaniedbyaroutingslipdetailingitsrequiredprocessingchain.Theframeworkautoma