Transfers between a member's own accounts

Design the transfer feature in a credit union's mobile app that moves money between a member's own accounts, such as checking to savings. All accounts live in the credit union's own database, transfers are immediate, and each member can transfer at most $10,000 a day. The credit union has 250,000 members and about 60,000 transfers a day, with spikes on paydays. The app may retry a request after a timeout, two transfers from the same account can run at the same moment, and no account may ever go below zero. Describe the data model, how one transfer runs, and how it stays correct under retries and concurrency.