I built a fiat-to-crypto onramp on my own, and the KYC integration worked perfectly on my machine.
The provider's sandbox answered almost instantly, and it answered with a decision every time: approved or rejected. So that is what I modeled. A request, a response, a user who moves forward or stops.
Live traffic answered differently.
Submissions came back pending and stayed pending. Some cases went to the provider's own human reviewers. One response carried a status my enum did not contain, and the deserializer just refused it.
Nothing crashed. Users sat parked in a state the interface could not explain, and I had no queue to open to go find them. The cost was not downtime: it was onboarding that quietly stopped converting while every health check stayed green.
What separated my machine from production was not Python, Docker, or environment variables. I had been talking to a different counterparty the whole time. A sandbox reproduces the shape of an answer. It does not reproduce the behaviour of one.
So now, for any third party on the money path, payments, KYC, carriers, custody:
Sandboxes are for payload shape only. Timing, retries, and state transitions get designed against the live contract, and I ask the provider directly what their slowest and strangest paths look like before I write the state machine.
And every integration gets an explicit unknown state that parks the case in a human review queue instead of forcing it into one of my categories.
If you integrate someone else's decision engine, your model probably needs somewhere to put an answer you did not anticipate...