How Razorpay Built Real-Time Anomaly Detection with Amazon MSK

This article describes how Razorpay built ADA (Anomaly Detection and Alerting), a real-time platform using Amazon MSK and Apache Flink to detect transaction anomalies across 500 million monthly transactions.

• Replaced static-threshold monitoring with adaptive, declarative detection using AdaDSL domain-specific language
• Amazon MSK serves as event backbone ingesting 5 billion daily events with three-replica durability and hot-reloadable rule updates
• Apache Flink performs stateful stream processing with sub-30-second anomaly detection and Complex Event Processing for fraud patterns
• Achieved 80 percent cost reduction, 99.99 percent uptime, and reduced false positives by over 90 percent
• Multi-tenant architecture isolates Payments, Payroll, and Banking business units on shared infrastructure
• Key learnings: separate rule definition from execution, use Kafka as unifying backbone, combine Flink with ClickHouse baselines, design for multi-tenancy from day one

The platform demonstrates how a reliable streaming layer is essential for operating payment infrastructure at scale, enabling real-time fraud detection and merchant-level alerting without alert fatigue.