Self-hosted reconciliation across nostro / GL, mobile money, and card-scheme settlements — one platform, on your infrastructure.
Start-of-day view: what needs attention before you open a queue.
Home boardBy the numbers
Auto-match rate observed in production at a West African commercial bank; figures vary by data quality and tier policy. Kilter is self-hosted — your data never leaves your infrastructure. Read the field report →
What's new
Six changes operators and auditors will notice first.
Whole deals matched, reviewed and confirmed as one balanced group — with net, principal + interest and settlement-lump cases explained.
A desk queue for balanced groups, with confirm-all for balanced days and review counts that count cards, not lines.
See how much is automated, per account and area. Assist suggestions earn promotion through a scorecard gate.
A full audit trail per open item, and a periodic access review in English and French.
A readiness checklist before you sign, one lock per session, and an auditable way to supersede a signed certificate.
Controls mapped to Bank of Ghana requirements, BCBS 239, ISO 20022 and DORA — evidence for your compliance team.
Five streams, one platform
Cash, Cards and Mobile Money run as three separated modules — each with its own routing rule and lock — on the same operator UI, audit log, role model and deployment. Train a team once and they can work any queue.
Reads raw SWIFT (MT940/950 · MT942 · MT900) and ISO 20022 (camt.052/053/054) directly — no transformation layer to license or configure — then pairs them against your core-banking GL extract. Four-tier engine — 75–85% auto-match on typical production data.
Cash tills balanced by day, as their own module with its own routing rule and lock. A till guard stops till lines from ever pairing across book days.
Ingests operator B2W / W2B feeds directly, pairing legs by msisdn in the narration. Pre-seeded profiles for the major networks. Wallets and switch reconciliation sit on one two-tab page.
N-way matching on scheme-ref, with card-scheme settlement lumps auto-cleared under strict rules only. PCI-DSS storage scope reduction built-in — full PAN never persists, masked at the parser seam.
Reconciles a Central Securities Depository statement of holdings against your investment ledger — matched on ISIN, nominal and maturity. The settlement cash leg is native nostro recon today; native CSD message ingestion (MT535 · semt) is a scoped connector.
Treasury securities
The same engine that reconciles your nostro statements pairs a Central Securities Depository statement of holdings against your investment ledger — position by position, on ISIN, nominal and maturity. The settlement cash leg is already native nostro recon.
ISIN → reference · nominal → amount · maturity → value date. Tier-1 only auto-confirms — the break stays for human review.
One platform
Same UI, same shortcuts, same review flow — every module behind one operator surface.
Every decision across every stream lands in one tamper-evident, UTC-stamped trail.
Maker / checker, five roles, segregation of duties — identical everywhere.
One self-hosted instance on your VM. No extra services to run.
No per-seat fees, ever. Pay by capacity, not headcount.
Frozen, signed snapshots — figures never shift after sign-off.
Operator workflow
Start the day on what needs attention, then see the whole book on one board — before you open a single queue.
A desk queue of whole deals: review each as one balanced group, or confirm-all for balanced days. Counts are cards, not lines.
How much is automated, per account and area. Assist suggestions are promoted only after a gate: 3 independent deciders and 5,000 labels.
The full audit trail for every open item — each touch, who made it and when — one click from the break.
Ctrl+K to jump anywhere from the keyboard. Reverse a match with a reason, or build a group by hand, without leaving the flow.
Two-sided matching · live
The correspondent's SWIFT statement on the left, your core-banking GL on the right. Lines draw between pairs as the engine runs — tier-graded, with variances and breaks flagged.
The matching engine
Four tiers, strongest-first. Operators review the exceptions; the engine handles the rest — tolerance windows, FX rounding, date drift.
Beyond pairs
Past the four tiers, Kilter reads how banks actually settle — whole deals, netted fees, lumps — and proves each group balances before it is confirmed.
A whole deal is reviewed and confirmed as one group. Payment and fees match by reference as one balanced group, with late fees linked.
A gross payment against a net statement line, with the bank charge explained and shown.
Principal and interest tied out and explained by the deal rate, not left as a variance.
Money-market settlement lumps and ACH / cheque clearing lumps matched as groups. Card-scheme lumps and repeated-attempt sets auto-clear under strict rules only.
Cash tills balanced by day never pair across book days — a till line can't be matched to the wrong day.
Large-variance confirms need a second confirm with a written reason. Rejected and reversed pairs are never re-proposed. A narration reader flags shared references, as advice only.
Measured on an anonymised 5.3M-row book: reverse-match lookup ~650 ms → ~0.1 ms; group confirm ~5 s → ~0.3 s.
Enterprise-grade
Beyond the engine: the controls, resilience and integration a treasury operations team needs before it trusts a reconciliation in production.
Every decision is sealed under chained SHA-256 anchors — any retroactive edit is detectable, and you can re-verify the whole chain on demand.
A maker requests, a different checker approves — enforced by the server, not by policy documents. Certificates add a multi-signer sign-off matrix.
Active-passive failover on a leader lease with provably zero double-fires. Take the active node down; the standby picks up the schedule.
Seed opening balances and open-item backlog in minutes — dry-run validated first. Any bank, not just a migration off the incumbent.
A read-only reporting API — including a dashboard overview endpoint — with revocable machine tokens, and HMAC-signed webhooks that push break events to your systems — only to endpoints you configure. Never to us.
Every real statement pathology becomes a permanent regression test, replayed on every change against PostgreSQL — part of 1,200+ automated tests guarding the engine.
Matching config lives in packs with revisions. New matching keys are staged as drafts and stay review-only until you trust them; a config change re-runs the open sessions.
Nostro report by account or area, a one-click proof-pack per area as PDF and Excel, and a reconciliation workbook split into “This day” and “Position at date”.
Kilter's controls mapped to Bank of Ghana requirements, BCBS 239, ISO 20022 and DORA — evidence by control, for the bank's own compliance team to assess. A mapping, not a certification.
Security & compliance
Microsoft / Google Authenticator out of the box; pair the optional AD / LDAPS layer for full password-plus-TOTP MFA. A replay cache blocks 30-second code reuse.
Runs as UID 10001, all Linux capabilities dropped, no-new-privileges enforced. Only mounts are writable.
TOTP secrets + SMTP creds protected with Fernet (AES-128-CBC + HMAC-SHA256). Key lives in your secret manager.
Every login, upload, match, dispute and export — UTC-stamped, blocked from UPDATE/DELETE at the DB, and sealed under a chained SHA-256 anchor you can re-verify on demand.
Full PAN never persists — masked to first6 + last4 at the parser seam. No SAD accepted; free-text redacted on ingest.
Runs on your VM or private cloud. No telemetry, no data leaves your infrastructure. You own the key and the data.
The reporting API takes scoped, revocable machine tokens (hashed at rest, constant-time compared) — and an automated test walks every route to prove no token can reach a write. Zero write surface, guaranteed by CI.
Maker-checker on write-offs — the most sensitive disposition — enforced by the server, not by policy: a different user must approve, with a full audit trail. Certificates support a multi-signer sign-off matrix.
Outbound break webhooks are optional, HMAC-SHA256 signed, https-only, and fire solely to the internal endpoints you configure. Verifiable, replay-resistant — and never to us.
A readiness checklist must pass before a certificate can be signed, and one lock holds each session. A signed certificate can be superseded — with the replacement and the reason on the audit trail.
A large-variance confirm needs a second confirm and a written reason of 10+ characters. Rejected or reversed pairs are never proposed again.
Automated and ops tooling signs actions as the tool itself — never impersonating a person — and periodic access review (EN/FR) keeps the user list honest.
Request a demo URL and drop in your own SWIFT, GL extract, mobile-money, or card-switch file. We'll run the engine and show you what week one looks like.
Book a 30-minute demo
