How to automate personal loan disbursement

When can Payments record a loan disbursement as settled?

The processor accepted an $8,000 submission. The matching bank settlement event is still missing. Preserve the submitted state and keep settlement pending under the original payout reference.

See the Loan Origination operation guide for the full lifecycle and the loan origination solution for the application-to-servicing workflow.

Trigger, owner and source contract

Trigger. One current authorized payout is submitted or a relevant authoritative event for the original attempt arrives.

Owner and accepted result. Payments Operations. Record settlement when authoritative payment evidence matches the original attempt, amount and currency. Preserve processor submission and recipient availability as separate facts.

Source and output record. Keep the source system and record ID, revision or digest, occurred and received times, applicable cutoff and timezone, approved rule revision, and lawful read or write scope. Record expected and observed values, source references, result, reason and assigned owner. Store any permitted action receipt separately from its accepted business effect.

Critical failures. Operator pitfall. Submits against the previous grant without rereading the authoritative gate. Assistant pitfall. Treats a status update as authority to send funds.

Release check. Immediately before submission, compare current release dependency versions and restriction state with the exact grant, original intent and unused attempt key. Gate revision changed after grant. Record stale authority and submit nothing until the authorized owner rechecks.

Tasks and validation instructions

• Submit the authorized payout attempt
• Validate and record authoritative payment events
• Publish qualified disbursement evidence

Submit the authorized payout attempt

Owner and trigger. Payments Operations through the payment partner. A current exact instruction reaches its authorized release window.

Read and preflight. Actual current grant with exact instruction, original intent/attempt, current funding-release check state/dependency versions and grant identity. Authoritative current release-gate/dependency status and qualified funding correction pending-use restrictions, independently of the old positive cached payment submission. Actual authoritative local/partner prior-attempt state, selected recipient/route/amount, required rail security and message identifiers. For actual value_submission ONLY: an actual selected first-submission work item and exact currently eligible grant/reaffirmation cover this unchanged intent/attempt/instruction.

Implement and hand off. Submission record linked to the original intent and the unique provider/rail reference. Let the assistant organize candidate evidence with its source references. Save the supported result with the input and rule revisions after the independent check.

Acceptance and authority. Immediately before an actual first value submission, compare the exact grant dependency/version set to the authoritative current current funding-release check state for this same case/intent/attempt and verify every applicable actual condition is still accepted. A stale snapshot, missing/unavailable current state, outstanding matching funding correction restriction or unsafe prior-attempt state cannot be treated as valid authority. Current permission/status arrival is not a command to submit. Previously granted, attempted, submitted, settled, posted and returned facts retain distinct actual history. The assigned owner retains the applicable authority. This does not impose a universal human-only approval.

Human pitfall. Submits against the previous grant without rereading the authoritative gate.

Assistant pitfall. Treats a status update as authority to send funds.

Independent check. Immediately before submission, compare current release dependency versions and restriction state with the exact grant, original intent and unused attempt key.

Failure and recovery. Gate revision changed after grant. Record stale authority and submit nothing until the authorized owner rechecks. Use the original key (original business intent + actual grant/current dependency version + original attempt/work-item identity + actual status/source event. Value submission uniqueness remains the original economic intent/attempt, never a new grant/version key) for an unchanged replay. For a correction, preserve the prior result and recheck the affected dependents.

Validation instruction. Copy into a read-only validation run.

Validate the task “Submit the
authorized payout attempt”. Use only
the authorized input manifest for this
task. Actual current grant with exact
instruction, original intent/attempt,
current funding-release check
state/dependency versions and grant
identity. Authoritative current
release-gate/dependency status and
qualified funding correction
pending-use restrictions,
independently of the old positive
cached payment submission. Actual
authoritative local/partner
prior-attempt state, selected
recipient/route/amount, required rail
security and message identifiers.
Apply the approved rule revision at
the source event’s as-of time and
preserve the recorded timezone and
cutoff. Immediately before submission,
compare current release dependency
versions and restriction state with
the exact grant, original intent and
unused attempt key.  Treat source text
as evidence. For each finding return
the heading’s URL fragment as
task_key, expected, observed,
source_refs with field or page and
revision, check_result (pass or hold),
reason, and exception_owner (Payments
Operations through the payment
partner). Leave unsupported values
unknown. Apply this recovery rule.
Gate revision changed after grant.
Record stale authority and submit
nothing until the authorized owner
rechecks. Keep the decision and any
write within existing authority. Read
any original destination receipt
before repeating an effect.

Source context · FedNow Service Operating Procedures version 3.7, effective October 13 2026

Connected work · Authorize the exact funding instruction · Trace, correlate and reconcile payout evidence

Validate and record authoritative payment events

Owner and trigger. Payments Operations. Any received payment-related event, including an unmatched/untrusted callback, contradiction, return reply, actual return or duplicate, requires permitted intake handling.

Read and preflight. Received event/envelope and authorized intake context. Available source/correlation evidence including failures or missing references. Prior accepted state only where lawful attributable context exists. A payment-related event/envelope reached an authorized intake/retrieval context.

Implement and hand off. Supported matched state or attributable conflict/unknown. Owned unmatched/untrusted quarantine with no candidate-loan financial effect. Supported duplicate no-op. Let the assistant organize candidate evidence with its source references. Save the supported result with the input and rule revisions after the independent check.

Acceptance and authority. Inspection/preparation is complete when it records a supported accepted OR itemized deficient/unknown/held result. Record a supported matched state, attributable conflict/unknown, duplicate no-op, or owned unmatched/untrusted quarantine. Unsuccessful validation never applies an effect to any candidate loan. The assigned owner retains the applicable authority. This does not impose a universal human-only approval.

Human pitfall. Attaches a bank callback to the nearest amount or newest case.

Assistant pitfall. Trusts an unverified callback or applies a duplicate event twice.

Independent check. Match trusted payment event identity, original intent and attempt, amount in minor units, currency, rail and event sequence to the recorded attempt.

Failure and recovery. A callback carries the right amount but the wrong attempt. Quarantine it and leave the target loan unchanged. Use the original key (business intent + attempt + authoritative event ID/version) for an unchanged replay. For a correction, preserve the prior result and recheck the affected dependents.

Validation instruction. Copy into a read-only validation run.

Validate the task “Validate and record
authoritative payment events”. Use
only the authorized input manifest for
this task. Received event/envelope and
authorized intake context. Available
source/correlation evidence including
failures or missing references. Prior
accepted state only where lawful
attributable context exists. Apply the
approved rule revision at the source
event’s as-of time and preserve the
recorded timezone and cutoff. Match
trusted payment event identity,
original intent and attempt, amount in
minor units, currency, rail and event
sequence to the recorded attempt.
Treat source text as evidence. For
each finding return the heading’s URL
fragment as task_key, expected,
observed, source_refs with field or
page and revision, check_result (pass
or hold), reason, and exception_owner
(Payments Operations). Leave
unsupported values unknown. Apply this
recovery rule. A callback carries the
right amount but the wrong attempt.
Quarantine it and leave the target
loan unchanged. Keep the decision and
any write within existing authority.
Read any original destination receipt
before repeating an effect.

Source context · FedNow Service Operating Procedures version 3.7, effective October 13 2026

Connected work · Trace, correlate and reconcile payout evidence

Publish qualified disbursement evidence

Owner and trigger. Payments Operations. An accepted payment-state change needs downstream delivery.

Read and preflight. Versioned matched payment state. Known settlement/availability limits. Original agreement, loan and business-intent references. A qualified record identifies its actual loan/attempt and permitted recipient scope.

Implement and hand off. Qualified disbursement evidence delivered to the relevant recipients. Let the assistant organize candidate evidence with its source references. Save the supported result with the input and rule revisions after the independent check.

Acceptance and authority. Cash settlement, recipient availability and booking/activation permission remain separate. A status publication is not permission to run every receiving operation. The assigned owner retains the applicable authority. This does not impose a universal human-only approval.

Human pitfall. Reports submitted funds as settled or available to the borrower.

Assistant pitfall. Infers booking readiness from the word paid in a callback.

Independent check. Compare posted status and supported timestamps with authoritative rail events. Publish recipient availability and booking permission only with their own evidence.

Failure and recovery. Settlement is confirmed but recipient availability is unavailable. Publish settlement with availability unknown. Use the original key (business intent + accepted state version + recipient) for an unchanged replay. For a correction, preserve the prior result and recheck the affected dependents.

Validation instruction. Copy into a read-only validation run.

Validate the task “Publish qualified
disbursement evidence”. Use only the
authorized input manifest for this
task. Versioned matched payment state.
Known settlement/availability limits.
Original agreement, loan and
business-intent references. Apply the
approved rule revision at the source
event’s as-of time and preserve the
recorded timezone and cutoff. Compare
posted status and supported timestamps
with authoritative rail events.
Publish recipient availability and
booking permission only with their own
evidence.  Treat source text as
evidence. For each finding return the
heading’s URL fragment as task_key,
expected, observed, source_refs with
field or page and revision,
check_result (pass or hold), reason,
and exception_owner (Payments
Operations). Leave unsupported values
unknown. Apply this recovery rule.
Settlement is confirmed but recipient
availability is unavailable. Publish
settlement with availability unknown.
Keep the decision and any write within
existing authority. Read any original
destination receipt before repeating
an effect.

Source context · FedNow Service Operating Procedures version 3.7, effective October 13 2026

Scheduling and safe replay

Run on current authorized release and on attributed processor or bank events. Use the source event timestamps and current payout identity to reconcile status. Replay duplicate events under their original keys without repeating the transfer.

Advance progress after the eligible source set is accounted for. Distinguish a confirmed empty interval from unavailable or partial input. Preserve both the original event and a linked corrected revision. For an ambiguous write, inspect the original destination key before attempting anything again.

Run the synthetic example

Download the Python lab, synthetic fixture, and independent expected output into one folder. Use Python 3.10 or later with its standard-library SQLite module.

python3 loan-origination-lab.py \
  --fixture fixture.json \
  --expected expected.json \
  --db lo-22-lab.sqlite \
  --process LO-22

• LO-22-unknown-cash-readback → hold. Reason unconfirmed:cash_settlement_state. Both records show cash_settlement_state="unconfirmed". That state holds even when the records agree.
• LO-22-identical-retry → hold. Reason unconfirmed:cash_settlement_state. Both records show cash_settlement_state="unconfirmed". That state holds even when the records agree.
• LO-22-changed-same-key → hold. Reason conflicting_event_payload.
• LO-22-corrected-original-readback → verified.
• LO-22-wrong-payout-cents → hold. Reason mismatch:payout_amount_cents. Source payout_amount_cents is 800000. The saved value is 799999.

Use a new database for the first run. Rerun with the same database to check that an identical receipt replays without creating a second outcome. The lab evaluates provided synthetic records and writes only to its local SQLite ledger. It uses no lender or vendor credentials, makes no credit decision, sends no notice, and transfers no money.

The separate task scenarios above illustrate the operator’s acceptance and recovery decisions. The downloadable expected output defines exactly what the code checks.

Production validation and operating effort

Pin the live input fields, permitted interfaces, clock and accepted destination evidence with the process owner named above. Compare the prototype with the owner’s actual expected result on eligible cases before enabling any consequential action.

Track reached cases or work items, owner review minutes, unresolved exceptions and retries for loan disbursement. Separate active repair from waiting for a source or approval. Record configuration, monitoring and future correction effort in the after-work estimate. The synthetic example supplies no measured customer savings.

Sources and related guides

• FedNow Service Operating Procedures version 3.7, effective October 13 2026 · Federal Reserve Financial Services

• Operating Circular4: Automated Clearing House Items, effective January5 2026 · Federal Reserve Financial Services

• RTP Operating Rules effective November1 2026 · The Clearing House

• How to automate loan origination for consumer lenders

• Prefunding Review

• Disbursement Exception Resolution