# Design an escrow service: system design interview question

> Partial releases, refunds, and disputes compete for one deposit while external transfers can have unknown outcomes.

Source: https://sysround.com/questions/design-escrow-service
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design an escrow service that holds money until the parties meet agreed release conditions. Support cancellations, disputes, and partial releases. The service must never release the same money twice."

## What to clarify first

- Scale and history
- Read and write traffic
- Money and deposits
- Provider and custody
- Release, refund, and cancellation rules
- Disputes
- Latency
- Consistency and availability
- Durability
- Excluded work

## Scope of a strong answer

Core requirements:

- Create an escrow with one fixed deposit
- Release or refund approved amounts without exceeding the deposit
- Cancel an escrow and refund the unused funds
- Freeze disputed funds and apply an authorized decision

Usually out of scope:

- Build a bank or payment provider
- Decide who wins a dispute
- Support currency exchange, fees, or interest
- Handle chargebacks after settlement
- Build identity checks or regulatory review systems

## What interviewers probe

### Money that enters an escrow

Different requests can create distinct deposits for one escrow. The service must distinguish repeated notices from additional money that actually arrived.

### How much money remains

Partial releases and refunds compete for the same deposit. A pending transfer consumes funds before the recipient receives money.

### Transfer outcomes

The provider can move money without returning a response. Delayed or repeated notices must not cause another transfer.

### Cancellations and disputes

Approvals can refer to amounts that later change. A dispute can freeze remaining funds but cannot recover money that already left.

## Common mistakes

- The design deduplicates deposit notices but permits multiple deposit instructions for one escrow.
- The design allows partial refunds without explicit amount and authority rules.
- The design ignores reserved funds when it calculates a refund.
- The service treats an external timeout as a failed transfer.
- The service allows stale cancellation approvals to authorize a different amount.
- The candidate adds distributed services before defining the financial invariants.

## The bar by level

- **Senior:** Enforces one deposit instruction and one accepted credit. Defines a balanced journal, provider recovery, refund authority, cancellation versions, and dispute races. Enforces the status staleness limit.
- **Staff+:** Defines guarantees across the database and provider boundary. Handles additional settlements, key expiry, restricted recovery, and reconciliation. Preserves acknowledged changes after one availability zone fails. Only if the interviewer asks the regional failure follow-up, defines regional ownership, failover, and duplicate prevention.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=escrow


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.