Payout engine async bank settlement

Design the payout engine that, on a schedule, nets each payee's earnings minus deductions into a single payout, batches thousands of payouts into ACH/SEPA files, submits them to a bank, and handles the slow, asynchronous, partially-failing nature of bank rails (a file is accepted but individual payouts bounce days later with return codes). ~800K payouts/day. A payout must be initiated exactly once, and a returned/failed payout must not be silently lost, the funds must flow back to the payee's available balance for retry. How do you keep the money correct across the multi-day async lifecycle?