Payments
ISO 20022, end to end: pain.001, pacs.008, camt.053, and acmt.001. Adopt one library at a time.
Explore the ISO 20022 librariesRead as…
Tailor the page order and highlights for your role.
# 1. Validate ISO 20022 pacs.008.001.10 (pip install pacs008)
pacs008 -t pacs.008.001.10 -m template.xml -s schema.xsd -d payments.csv --dry-run
✓ Schema validation passed
✓ Data validation passed (1 payment records)
# 2. Verify NIST FIPS 203 ML-KEM-768 KEM (cargo add kyberlib)
cargo test -p kyberlib --test test_kem
✓ test keypair_encap_decap ... ok
✓ test result: ok. 9 passed; 0 failed; finished in 0.01s
# 3. Verify live CycloneDX SBOM provenance (SLSA / Sigstore)
curl -sSLO https://sebastienrousseau.com/sbom.cdx.json && gh attestation verify sbom.cdx.json --owner sebastienrousseau
✓ Loaded 1 attestation from GitHub API (slsa.dev/provenance/v1)
✓ Verification succeeded!What I build
Open-source foundations for wholesale finance.
Security
Post-quantum primitives: ML-KEM (CRYSTALS-Kyber, NIST FIPS 203) and hashing, ready to pilot today.
See the post-quantum primitivesTooling
Audited Rust libraries and a code security scanner, signed and shipped with a software bill of materials.
View the toolingProof
By the numbers.
51.2M All-time downloads
3.7M Downloads, last 30 days
707 GitHub stars
179 Packages published
Most downloads come from transitive dependencies in CI/CD pipelines and production services across PyPI, crates.io, and npm · Updated .
Career
Where I've worked.
Nearly two decades of in-house payments and digital product leadership at HSBC, PayPal, Barclays, Shazam, AKQA, and Virgin Group.
EPAA · September 2025
Why the payments industry must act now.
Regulators are treating harvest-now-decrypt-later as a credible present risk. This paper, produced for the Emerging Payments Association Asia, sets out the structural threat and the case for coordinated action across wholesale payment rails.
Latest
From the desk.
EU Data Act · Cloud Switching · DORA
Your DORA Exit Plan Was Priced, Not Planned. The Price Disappears in January.
TL;DR From 12 January 2027 cloud switching charges are abolished, egress included. The cost defence that kept DORA exit plans theoretical expires with them.
Cyber Resilience Act · CRA · DORA
DORA Spared You From NIS2. It Will Not Spare You From the CRA.
TL;DR On 11 September the CRA starts a 24-hour reporting clock. It attaches to products, so the DORA carve-out that spares banks from NIS2 never reaches it.
EU AI Act · Article 50 · AI Governance
Your High-Risk Deadline Moved to December 2027. Your Chatbot's Did Not.
TL;DR The AI Omnibus moved the high-risk deadline to December 2027. It did not move Article 50. Transparency obligations apply from today, and they land on the chatbot.