Start with the customer action that puts value in motion—top-up, card swipe, loan disbursement, merchant settlement. Draw each hop to a system you own, a partner you call, or a network you cannot pause alone. Label where logs exist today, not where architecture diagrams wish they existed.
Mark the freeze points
Beside each hop, note who can slow or stop the flow and how long that action takes to propagate. Incident response audits repeatedly ask whether your freeze ladder matches reality. If merchant payouts take forty minutes to halt, write forty minutes.
Attach evidence handles
For every hop, list a primary evidence handle: ticket queue, log index, chat channel, or vendor portal export. During the Fintech Incident Response Audit Program we grade whether those handles appear in the detection chronology without oral footnotes.
Keep the map ugly and current
Pretty diagrams age badly. Prefer a dated sketch in the binder with a changelog. When partners in Korea request diligence, a current rail map shortens the first meeting more than a polished narrative without anchors.