Money

Payouts, refunds, and recovery

How Neo handles money going out, reversals, failures, and later corrections.

Last updated 2026-07-254 sections

Payout recipient lifecycle

Seller and creator owners give consent and enter a provider-hosted protected verification flow. Neo stores encrypted or masked provider references, not raw identity documents. Operations reviews eligibility and one active recipient. Replacement introduces a cooling period. Bank-name resolution alone is not payout eligibility.

Transfer lifecycle

stateDiagram-v2
  [*] --> Eligible: funded, available, verified
  Eligible --> Queued: stable attempt and outbox
  Queued --> Processing: delivery-time revalidation
  Processing --> Paid: provider-confirmed evidence
  Processing --> Reconciling: ambiguous outcome
  Processing --> Failed: terminal rejection
  Reconciling --> Paid: callback or poll success
  Reconciling --> Failed: confirmed provider failure

If the diagram does not render, its Mermaid source remains readable above.

Queueing and delivery revalidate owner scope, recipient, risk, cooling, funded balance, policy, provider limits, kill switch, certification, and financial reconciliation. Generic replay cannot execute a transfer.

Refund and chargeback recovery

flowchart LR
  Request[Buyer refund request] --> Gate[Eligibility and kill switch]
  Gate --> Command[Stable provider command]
  Command --> Evidence[Callback, poll, or reviewed evidence]
  Evidence --> Reverse[Original-owner compensation journal]
  Reverse --> Hold[Reserve and payout freeze]
  Hold --> Negative[Visible negative balance if already paid]
  Future[Future capture] --> Offset[Atomic recovery offset]
  Negative --> Offset

If the diagram does not render, its Mermaid source remains readable above.

Full and partial adjustments reverse the original allocation, not a guessed split. Already-paid losses remain visible and are recovered from future settlement without editing history. Duplicate and conflicting events are retained as evidence and converge on one legal state.

Production availability

Implemented and tested Recipient, Paystack transfer, signed callback, reconciliation, refund, reserve, negative-balance, and protected operations machinery.

Disabled or uncertified General live payout transfers and live refunds. Paystack is the selected live payout adapter, but the exact production target is not yet certified and both money-movement switches remain fail-closed. Closed-beta sandbox payout moves no money; test-mode refunds are not live-money evidence.

src/payout-provider.ts
src/payout-verification.ts
src/payout-execution.ts
src/payout-reconciliation.ts
src/payment-adjustments.ts
test/payout-provider.test.ts
test/payout-execution.test.ts
test/payment-adjustments.test.ts