Payments
ISO 20022, end to end: pain.001, pacs.008, camt.053, and acmt.001. Adopt one library at a time.
Explore the ISO 20022 librariesRead as…
Tailor the page order and highlights for your role.
# 1. Validate ISO 20022 pacs.008.001.10 (pip install pacs008)
pacs008 -t pacs.008.001.10 -m template.xml -s schema.xsd -d payments.csv --dry-run
✓ Schema validation passed
✓ Data validation passed (1 payment records)
# 2. Verify NIST FIPS 203 ML-KEM-768 KEM (cargo add kyberlib)
cargo test -p kyberlib --test test_kem
✓ test keypair_encap_decap ... ok
✓ test result: ok. 9 passed; 0 failed; finished in 0.01s
# 3. Verify live CycloneDX SBOM provenance (SLSA / Sigstore)
curl -sSLO https://sebastienrousseau.com/sbom.cdx.json && gh attestation verify sbom.cdx.json --owner sebastienrousseau
✓ Loaded 1 attestation from GitHub API (slsa.dev/provenance/v1)
✓ Verification succeeded!What I build
Open-source foundations for wholesale finance.
Security
Post-quantum primitives: ML-KEM (CRYSTALS-Kyber, NIST FIPS 203) and hashing, ready to pilot today.
See the post-quantum primitivesTooling
Audited Rust libraries and a code security scanner, signed and shipped with a software bill of materials.
View the toolingProof
By the numbers.
52.1M All-time downloads
3.7M Downloads, last 30 days
719 GitHub stars
179 Packages published
Most downloads come from transitive dependencies in CI/CD pipelines and production services across PyPI, crates.io, and npm · Updated .
Career
Where I've worked.
Nearly two decades of in-house payments and digital product leadership at HSBC, PayPal, Barclays, Shazam, AKQA, and Virgin Group.
EPAA · September 2025
Why the payments industry must act now.
Regulators are treating harvest-now-decrypt-later as a credible present risk. This paper, produced for the Emerging Payments Association Asia, sets out the structural threat and the case for coordinated action across wholesale payment rails.
Latest
From the desk.
AI · AI Governance · Compliance
Why the FCA Is Regulating AI Without an AI Rulebook
TL;DR The FCA describes itself as a technology-agnostic, principles-based and outcomes-focused regulator, and it applies that stance to AI. Its rules don't usually mandate or prohibit specific...
Cybersecurity · Cryptography · AI
The Mystery Seeds Behind NIST's Curves Were Never Hashes, and Claude Found Out in Under Half an Hour
TL;DR The seeds published with the NIST P-192, P-224, P-256, P-384 and P-521 curves were never hash outputs. They came from the C library's lrand48 generator, seeded by Unix timestamp. Claude worked...
AI · Agentic AI · Generative AI
Agentic AI breaks the assumption behind every task-exposure forecast
TL;DR Task-exposure frameworks treat an occupation as a shell that survives around whatever humans still do. Agentic systems pursue a goal and deliver a finished work product, so the coordination work...