Pacsmith

More than 1,700 banks and credit unions had joined the network by the first quarter of 2026, and many signed up only to receive — the Federal Reserve does not publish how many of them can send. Building the send side — ISO 20022 messaging, signing, timeout reconciliation, 24x7 operations — is where the cost is. Pacsmith is a reference toolchain that lowers it: a message library, a local simulator, a send gateway and client SDKs.

Two people arrive here wanting opposite first pages. Pick yours.

Build

You are an engineer. You want it running before you want to read about it.

• Quick start — a payment that settles, one that is rejected, and the timeout case, in five minutes with Docker and curl.
• Integration handbook — the credit transfer flow, timeout reconciliation, returns, and getting through certification testing.
• SDKs — Python (zero dependencies) and Java (one), both integration-tested against a live stack in CI.
• Gateway API — idempotency-keyed submits, payment state, reconciliation and ops endpoints.

Evaluate

You are in risk, security or procurement. You want to know what you would be adopting.

• Signed releases — keyless Sigstore signatures, with the exact cosign verify-blob command to check one yourself.
• SBOM — CycloneDX and SPDX, on every release.
• OpenSSF Scorecard — a public, third-party score, updated weekly.
• Vulnerability disclosure — where to send a report and what happens next.
• Licence — Apache-2.0, patent grant included.

Where the project stands

Early development, v0.3.1. The complete send loop works end to end — build, validate, send, advise, reconcile — with production-style MQ semantics, the returns message set, and Python and Java clients. It is not production-ready, pre-1.0 minor versions may break APIs, and nothing here is certified by anyone. Message signing is still blocked on access-controlled specifications. The overview has the honest version.