OTC Backend System Development with API Integration

We’re building a production-grade backend system for an OTC operation integrated with Binance P2P Merchant API, NPP (fiat payment rails), and Sumsub (KYC/KYB/AML). The system runs entirely in the backend, while all customer-facing interactions (ads, orders, chat, KYC screens) remain on Binance’s native front end. The goal is to automate order execution, payment settlement, KYC checks, and reconciliation — and make the system franchise/white-label ready for multi-tenant use. Objectives Automate OTC operations on Binance P2P via API (ads, pricing, orders, status). Automate fiat flows using NPP (inbound/outbound with reconciliation and retries). Automate identity/risk checks using Sumsub webhooks (L1/L2/L3 tiering, AML flags). Enable franchising: multi-tenant isolation, one-click tenant setup, revenue split, brand config. Deliverables 1. Connectors • Sumsub: applicant create/continue, webhook decisions, risk snapshots, tiering (L1/L2/L3). • NPP: pay-in webhook consumer (unique reference matching), payout initiation, signature verification, idempotency, retries, exception queue, daily reconciliation. • Binance P2P: ad lifecycle (create/pause/update), pricing bot (spread/fees/FX/inventory formula), order ingestion & state machine, evidence bundle (receipt hash, payer name/BSB last 4, timestamps). 2. Operator Console (Web) • Views: Orders, Payments, Reconciliation, Users/KYC, Rules, Alerts. • Actions: Approve/Reject, Pause ads, Retry payouts, (if needed) manual release. • Two-person control for releases & rule changes. RBAC: Admin/Operator/Finance/Compliance/Franchisor/Franchisee. 3. Ledger & Reconciliation • Double-entry journal (immutable append log). • Daily reconciliation: internal ledger vs NPP statements; exceptions queue; CSV exports for audit/banks. 4. Franchise/White-Label Kit • Multi-tenant isolation (data, secrets, configs per tenant). • One-click tenant bootstrap (brand, domain, logo, spread, fees, limits, risk thresholds, API keys). • Franchisor dashboard (cross-tenant KPIs); Franchisee sees only its own data. • Revenue share reporting; white-label themes & email templates. 5. Security & Compliance • Field-level PII encryption (KMS/rotation), least-privilege IAM, webhook signature checks, write-once audit logs. • AUSTRAC-friendly artifacts: CDD/EDD mapping, ongoing monitoring, SMR/SAR draft templates, 7-year retention. 6. Docs & Runbooks • OpenAPI contracts, sequence diagrams, env/secrets matrix, reconciliation SOP, incident playbooks, tenant onboarding guide.