A domestic switch
that keeps the interchange
inside Bangladesh.

What is IntraPay

A switch for the country.
Not a wrapper around one.

IntraPay is a domestic payment switch for Bangladesh. It does three things that today require three vendors: it authorizes ISO 8583 card transactions on a sovereign 9xxx BIN range, it generates and clears BanglaQR scan-to-pay flows, and it aggregates the bKash, Nagad, and Rocket mobile-financial rails behind one merchant API.

The Rust switch processes ISO 8583 on the hot path in under one millisecond. Twelve Go microservices handle clearing, settlement, tokenization, fraud, KYC, and partner portals. The Settlement Engine instructs Bangladesh Bank RTGS for high-value and BACH for batch. PCI DSS Level 1 controls, a Thales Luna HSM with post-quantum CRYSTALS-Kyber and Dilithium, and Wenme plus Darwan for participant auth round out the operator stack.

One card transaction, end to end

What happens between
swipe and approval.

ISO 8583 in, ISO 8583 out, with a Kafka event projection per stage so clearing, settlement, dispute, and audit consumers rebuild state from the same canonical log.

1. 01

   Acquirer terminal posts ISO 8583

   POS or e-commerce gateway sends a 0100 authorization request over a mutually authenticated TLS channel to the acquirer-bound switch endpoint. The Rust switch parses the message inside a fixed-budget micro-task without allocation on the hot path.

2. 02

   Fraud ML scores in stream

   The Python PyTorch fraud service consumes the request from a Kafka topic and returns a risk score under 30 ms. Score and rule trace are attached to the transaction context for the auth decision.

3. 03

   PQC auth via HSM

   Auth service evaluates issuer rules, signs the request with a CRYSTALS-Dilithium key held in a Thales Luna HSM, and forwards to the issuer bank over a Kyber-wrapped session. PIN block is verified inside the HSM, never in process memory.

4. 04

   Issuer decision returns

   Issuer bank returns 0110 with action code, IntraPay completes the response chain back to the acquirer, and the Kafka event stream forks into clearing, settlement, dispute, and audit projections.

Operator posture

Built like the
infrastructure it replaces.

The card networks IntraPay competes with run on the same primitives: synchronous replication, HSM-backed keys, audited change control, observed every hop. IntraPay matches them on substance, not on slogans.

What is shipped, what is pending

Engineering complete.
Regulator pending.

We do not claim shipped what is not. The regulator-side milestones (BB PSP licensing, 9xxx BIN allocation, and bank pilots) are the gating path to live volume.

• Phase 1Core infra: K8s, Postgres + Patroni, Kafka, Redis, Istio, HSM shipped
• Phase 2Card switch (Rust), Transaction Engine, Token Vault, Auth shipped
• Phase 3BanglaQR engine, MFS aggregator (bKash, Nagad, Rocket) shipped
• Phase 4Clearing, Settlement, Fraud ML, Dispute management shipped
• Phase 5Merchant API, SDK, Portal, OpenAPI 3.1 specification shipped
• Phase 6Issuer + Acquirer portals, partner sandbox shipped
• Phase 6Pilot integration with 2 to 3 banks, 1 to 2 MFS providers pending
• Phase 7Chittagong active-active, Sylhet cold DR, RTO under 30s shipped
• Phase 8PCI DSS Level 1 audit, k6 load tests, runbooks shipped
• Phase 8Bangladesh Bank PSP licence, 9xxx BIN allocation, pen test pending
• Phase 9Wenme OAuth 2.1 + DPoP, Darwan RBAC across 35 permission keys shipped

FAQ

Questions banks
actually ask.

Six answers covering scope, comparison, BanglaQR, latency, NPSB and BEFTN interop, regulator state, and participant economics. Mirrored 1:1 in FAQPage JSON-LD.