The problem
“Our ledger disagrees with our provider and we find out at month end”
Double-entry ledger, idempotency, and daily reconciliation
A balance should be derived from entries, never stored. Every movement is two rows, and "pending" is a first-class state with its own ageing report rather than an error nobody looks at.
Around that sits the reliability layer: idempotency keys required on every write so a retried request cannot pay twice, webhook verification and replay handling, a poller that chases unresolved transactions to a terminal state, and a daily job comparing your position against the provider's statement that alerts on any non-zero delta.
Finding a small discrepancy the day it appears is ten minutes. Finding it at quarter end is a week.
You keepA ledger you can audit, and an exceptions queue instead of silent drift