SPI: 24x7 real-time gross settlement, active-active, zero RPO

01 · CONTEXT

The system that settles Pix

The SPI is the centralized real-time gross settlement (RTGS) infrastructure of the Pix arrangement. Its purpose is to settle credit orders between direct participating institutions, moving the Instant Payment Accounts (PI Accounts) held at the Central Bank.

Operation is uninterrupted: 24 hours a day, 7 days a week, including holidays. The SPI also has no closing windows or settlement cycles.

In 2024, the SPI processed more than 56 billion transactions, and the average availability index was 99.98%, above the regulatory minimum of 99.90%. The document reports more than nine hundred participating institutions, direct and indirect.

02 · SETTLEMENT

Balance first, immediate settlement

Settlement is done in central bank money, by debit and credit between PI Accounts held at the BC by direct participating institutions, and the SPI only settles with available balance in the payer's PI Account.

1. The payment order reaches the SPI as a standardized message, transmitted over the RSFN.

2. To settle, the transaction must obtain all required validations, including from the payee institution, and have a balance reserved in the payer's PI Account when the SPI receives the order.

3. Once these conditions are met, the SPI immediately moves the funds, by debit and credit between PI Accounts.

4. Without available balance, the transaction is automatically rejected: there is no queue or wait for future balance.

In the SPI there are no waiting queues, offsets, or dependence on later coverage. According to the document, operational risk is the main residual risk the system is exposed to.

Messages follow the ISO 20022 standard, represented in XML, and access to the SPI is authenticated by digital certificates.

A deep-dive point for the interview: when two orders from the same payer compete for the same balance, what mechanism keeps it from being spent twice? Think about consistency and about distributed transactions.

03 · ACTIVE-ACTIVE

Two centers, synchronous replication, and zero RPO

The SPI keeps two service centers at distinct locations, with synchronous data replication. Both operate in ativo-ativo, with load distribution, and both are able to fully take over the system's activities, even in cases of severe failure.

1. The SPI runs in two Information Technology Service Centers (CSIs), installed at distinct locations, with synchronous data replication.

2. The two centers operate in an active-active setup, with load distribution, and both are able to fully take over the system's activities, even in cases of severe failure.

3. The recovery parameters are an RTO of fifteen minutes and an RPO of zero, set in a service level agreement between the responsible departments and regularly tested.

4. Participants' access goes through the RSFN, which offers two independent telecommunication networks, with redundancy.

5. The design aims to have no single points of failure, with redundancy in both CSIs and use of different RSFN providers.

6. Teams in Brasília and São Paulo monitor the system in real time, supported by automated tools.

04 · FAILURES

An undefined state does not exist

After an interruption, the SPI automatically identifies the transactions received and not settled before the stop and rejects them if the forty-second expiration time has been reached. According to the document, this approach prevents transactions from existing in an undefined state.

The system has mechanisms for idempotency and for querying the status of the operation, which allows the participant to check the result of a transaction at any time, even after unavailability or a communication failure.

The RTO and RPO are set in a service level agreement between the responsible departments and regularly tested, and capacity is reviewed quarterly based on demand projections. The monitoramento is performed in real time by teams in Brasília and São Paulo.

05 · IN THE INTERVIEW

Questions for designing the SPI

When designing a system like this, discuss the cost synchronous replication imposes on the latency of each write, how to reconcile balances and messages, and what the participant sees when an order is rejected. Each decision here trades disponibilidade for complexity, and the choice needs to be justified by the system's targets.