Stress-test a settlement delay by proving that each window can keep funds inside the planned clock, survive bank-calendar shifts, and avoid trapping merchants inside a green ops slide that hides long-lived mismatch.
Delay packages often list a day count while leaving holiday mapping, rail failover, and abort authority implicit. Those edges decide whether a late bank cutover stops inside the window or leaves merchants on misleading ETA language. The exercise should follow actual settlement files, processor samples, and review paths rather than a clean schedule deck.
Inventory the delay path
List every settlement class with its window budget, calendar source, override target, owners, and notification channels. Mark classes that cannot reverse without a manual ledger edit. Attach the last three delay incidents with raw samples and any waivers. Include the source of truth for live ETAs during the observation window.
Define phases for draft, sample, observe, abort, and communicate. Each phase needs an owner and an exit condition. Write the point after which a stuck settlement set would require a different procedure, then review whether that action is still permitted. Capture maximum acceptable merchant-visible lag in measurable units, including which cohorts are excluded from the new delay and why.
Include the calendar of known events for the next two quarters: processor migrations, partner launches, and support peaks that shrink the usable rewrite window. A delay budget that ignores those dates will look calm until the week they land.
Failure drills
- A minority money path keeps an old ETA while the aggregate settlement dashboard stays green.
- A rewrite has already left a partner payout on a misleading promise.
- The primary bank sample lags beyond the planned observation window.
- An operator extends the delay because a launch demo is close.
- Holiday and rail tokens collide under the new window threshold.
- Abort authority is unclear at midnight and funds land on the wrong clock.
For each drill, identify detection time, merchant impact, containment, and the authority to force a settlement revert. Require ledger links and sample processor exports in the runbook. A statement that monitoring will catch it does not establish which alert fires or who receives it.
Prove delays are timed and owned
Run the package in Pingpong with payments ops, finance, support, and product seats. Ask product which merchant decision becomes unsafe first if ETAs still misstate the window after the claimed clock. Ask finance whether abort can absorb a forced bank extension. Ask payments ops to show the exact field edit or processor API used as the exit condition.
Related reviews include the payments ops lead seat, a payout hold policy review, and a payout schedule stress test. Browse the war-game decisions hub for adjacent controls.
Authorize the published delay only after a timed drill restores accurate ETAs inside the documented budget without an undocumented manual step.