Worked Example: Payment Services

A bank's payment services sit under some of the heaviest regulatory weight in financial services — PSD2 Strong Customer Authentication, PCI-DSS, anti-money-laundering obligations — while carrying a threat that never stops evolving: payment fraud and authorised-push-payment scams. This example instantiates the Security Services Domain Model for that scenario: the business driver is simply moving money safely; the risk is loss and regulatory breach; and the chain runs through a payment security policy, a fraud screening and SCA service, transaction scoring workflows, and down to the actual fraud detection platform and 3-D Secure step-up that execute it in production. It shows how the same generic model carries the specific regulatory and fraud-control weight a payments domain actually has to bear.