Introduction

QR code payments have evolved from simple peer-to-peer transfers to complex enterprise-grade transaction rails. However, as financial institutions scale QR payment ecosystems across borders and merchant categories, they face a critical challenge: enforcing dynamic bank policies in real-time. Traditional rule engines are brittle, and standard LLM chatbots lack the deterministic state management required for financial compliance. This article explores an enterprise-grade solution using LangGraph to orchestrate a multi-agent system. Unlike linear chains, LangGraph allows for cyclic graphs with persistent state, making it ideal for transactions that require validation, retrieval of regulatory context (RAG), and human-in-the-loop approval. We will demonstrate how to build a system where agents collaborate to process QR payments while strictly adhering to evolving bank policies stored in a vector database.

Real-Time Use Case: Cross-Border Merchant Settlement

Consider "GlobalPay," a fintech enabling QR payments between Southeast Asian merchants and European tourists. A customer scans a QR code at a Bangkok street vendor for 50,000 THB. The system must instantly:

  1. Validate the QR payload format.

  2. Check if the merchant’s KYC tier permits this volume.

  3. Retrieve the latest cross-border FX cap policy from the bank’s internal documentation (which changes weekly).

  4. Flag transactions exceeding risk thresholds for compliance review.

  5. Maintain conversation state if the user is asked to provide additional verification via a chat interface.

A single monolithic LLM call cannot reliably handle this. Instead, we deploy specialized agents: a Router Agent, a Policy Retrieval Agent (RAG), a Transaction Validator Agent, and a Compliance Supervisor.

Architecture Overview: Multi-Agent LangGraph with RAG

LangGraph models the payment flow as a directed graph where nodes represent agent logic and edges represent conditional transitions based on state.

  • State Schema: A Pydantic model holding transaction details, current policy rules, risk scores, and message history.

  • RAG Node: Connects to Azure AI Search or pgvector to fetch specific bank policy clauses relevant to the transaction amount and corridor.

  • Memory: Uses LangGraph’s checkpointing (e.g., PostgreSQL saver) to persist state across API calls, allowing users to resume interrupted verifications.

  • Cyclic Logic: If the Compliance Supervisor rejects a transaction due to missing docs, the graph loops back to the User Interaction node rather than terminating.

State Management and Bank Policy Memory

In financial systems, "memory" isn't just chat history; it’s structured transactional context. We define a PaymentState that acts as the single source of truth. This state is passed between nodes, ensuring that when the RAG agent retrieves a policy, the Validator agent sees it immediately without re-querying.

Crucially, bank policies are versioned. The RAG system must filter by effective_date and jurisdiction. When a policy updates, the vector index is refreshed, and the multi-agent system automatically adapts without code deployment.

Code Implementation: Defining the Graph and Agents

Below is a simplified implementation demonstrating the core LangGraph structure for QR payment processing.

from typing import Annotated, TypedDict, Literal
from langgraph.graph import StateGraph, END
from langchain_core.messages import HumanMessage
from pydantic import BaseModel, Field

# 1. Define Structured State for Financial Context
class PaymentState(TypedDict):
    qr_payload: str
    amount: float
    currency: str
    merchant_id: str
    policy_context: str  # Retrieved via RAG
    risk_score: float
    messages: list[HumanMessage]
    status: Literal["pending", "approved", "rejected", "needs_verification"]

# 2. Specialized Agent Nodes
def policy_retrieval_node(state: PaymentState) -> dict:
    """RAG node: Fetches relevant bank policy based on amount/corridor."""
    # In production: invoke Azure AI Search / pgvector retriever
    # Filter by jurisdiction and effective_date
    retrieved_policy = f"Cross-border cap for {state['currency']}: 60,000 THB. KYC Tier 2 required."
    return {"policy_context": retrieved_policy}

def transaction_validator_node(state: PaymentState) -> dict:
    """Validates transaction against retrieved policy deterministically."""
    if state["amount"] > 60000 and "Tier 2" not in state.get("merchant_kyc", ""):
        return {"status": "rejected", "risk_score": 0.9}
    return {"status": "approved", "risk_score": 0.1}

def compliance_supervisor(state: PaymentState) -> Literal["end", "user_verification"]:
    """Conditional edge: Routes based on validation result."""
    if state["status"] == "rejected":
        return "user_verification"
    return "end"

# 3. Build the LangGraph Workflow
workflow = StateGraph(PaymentState)

workflow.add_node("retrieve_policy", policy_retrieval_node)
workflow.add_node("validate_transaction", transaction_validator_node)
workflow.add_node("request_verification", lambda s: {"messages": [HumanMessage(content="Please upload ID for Tier 2 verification.")]})

workflow.set_entry_point("retrieve_policy")
workflow.add_edge("retrieve_policy", "validate_transaction")
workflow.add_conditional_edges(
    "validate_transaction",
    compliance_supervisor,
    {"end": END, "user_verification": "request_verification"}
)
workflow.add_edge("request_verification", "retrieve_policy")  # Loop after user provides info

app = workflow.compile(checkpointer=memory_saver)  # Persistent memory for session continuity

Integrating RAG for Dynamic Policy Retrieval

The policy_retrieval_node should not use naive semantic search. For bank policies, implement Hybrid Search combining keyword matching (for exact regulation codes like "PDPA-2024-QR") and semantic similarity. Use metadata filtering to ensure only active policies for the specific banking license are retrieved. Additionally, implement a Policy Citation Guardrail. After retrieval, run a lightweight validation step to ensure the cited policy actually supports the agent’s decision. This prevents hallucinated compliance rules—a non-negotiable requirement in fintech. Store citations in the PaymentState so audit logs can trace every decision back to a specific document version.

Conclusion

Enterprise QR payment systems demand more than conversational AI; they require orchestrated, stateful, and auditable intelligence. By combining LangGraph’s cyclic multi-agent architecture with RAG-grounded policy retrieval, banks can automate complex compliance checks while maintaining the flexibility to adapt to regulatory changes instantly. The key success factors are structured state design, deterministic validation layers, and robust memory persistence. This architecture transforms QR payments from simple scan-and-pay interactions into intelligent, policy-aware financial services that scale securely across global markets. As you build training materials or prepare for architect-level interviews, emphasize that state management and auditability differentiate enterprise AI from hobbyist projects. The ability to explain why a transaction was approved and cite the exact policy clause is what builds trust with regulators and customers alike.