FinTech Vocabulary for Developers: Payments, Banking APIs, and Financial Tech Terms

Building payment systems or integrating banking APIs without understanding the domain vocabulary is like navigating a foreign city without a map. Developers who join FinTech companies frequently underestimate how specialised the language is. Saying “we process the credit card” in a meeting will mark you as a newcomer immediately — the correct phrasing, and more importantly the correct mental model, matters enormously in this industry.

The Payment Flow Vocabulary

When a customer pays online, the transaction travels through several parties. The payment gateway is the technology layer that captures, encrypts, and routes card data from the merchant’s checkout to the payment network. Stripe, Adyen, and Braintree are common examples.

The acquiring bank (or acquirer) is the bank that holds the merchant’s account and processes payments on the merchant’s behalf. The issuing bank (or issuer) is the bank that issued the customer’s card. When a payment is made, the acquirer requests authorisation from the issuer through the card network (Visa, Mastercard).

PCI-DSS (Payment Card Industry Data Security Standard) is the security framework that governs how card data must be handled. Engineers say: “We cannot store raw card numbers anywhere in our systems — PCI-DSS compliance requires us to use tokenisation.”

Tokenisation (card tokenisation) replaces a card number (PAN — Primary Account Number) with a non-sensitive token. The token can be stored safely; the actual card data lives in the payment gateway’s vault. This is different from privacy tokenisation — the context always makes it clear which type is meant.

3DS authentication (3D Secure) is the protocol that adds an extra authentication step — an SMS code, biometric, or app approval — to online card transactions. You will hear: “3DS2 frictionless flow passes the transaction without a challenge if the risk score is low enough.”

Banking Infrastructure Terms

IBAN (International Bank Account Number) identifies a bank account internationally. SWIFT (Society for Worldwide Interbank Financial Telecommunication) is the messaging network banks use for international transfers. A BIC (Bank Identifier Code, also called SWIFT code) identifies the specific bank. Engineers building international payment features need to validate all three formats.

Open banking is the regulatory framework — mandated by PSD2 (the EU’s Revised Payment Services Directive) in Europe — that requires banks to expose their data and payment initiation capabilities through APIs to licensed third parties. This enabled a wave of FinTech products built on top of bank account data.

SEPA Instant (Single Euro Payments Area Instant Credit Transfer) and FedNow (the US Federal Reserve’s instant payment system) are instant payment rails — transactions that settle in seconds, 24/7/365. Engineers say: “The user expects instant confirmation — we need to integrate SEPA Instant, not a standard SEPA Credit Transfer.”

Accounting and Reconciliation

Settlement is the actual movement of funds between banks after authorisation — authorisation reserves the funds, settlement transfers them. The gap between the two (sometimes days) is a common source of confusion for developers new to payments.

Reconciliation is the process of matching payment records across systems — comparing your internal ledger against the payment processor’s reports to identify discrepancies. A ledger records all financial transactions. Double-entry bookkeeping means every transaction creates two entries: a debit on one account and a credit on another. FinTech engineers who understand this can reason about accounting bugs far more effectively.

API Patterns

Webhooks for payment events are server-to-server notifications that inform your system when a payment status changes — paid, failed, refunded, disputed. “Don’t poll the payment API for status — subscribe to the payment.succeeded webhook.”

Idempotency in payments means that submitting the same payment request multiple times produces the same result without double-charging. APIs achieve this through an idempotency key — a unique identifier sent with each request. “Always generate a fresh idempotency key per user intent, not per retry attempt — retries should reuse the same key.”

Practice

Find the API documentation for Stripe or Adyen and read one section — payment intents, refunds, or webhooks. Identify five terms from this article in the documentation and write one sentence for each explaining what it means in your own words.