Every system you trust is downstream of one record
Pull the thread on any EV-charging dispute and you reach the same knot: a number that should be identical in three places, and isn’t.
The acquirer says one amount was settled. The driver’s receipt says another. Your reporting dashboard shows a third, and the tax office has a fourth on file. Four systems, four truths — and somewhere upstream, a single record that was supposed to make them agree.
That record is the Charge Detail Record, the CDR — the settlement object that OCPI, the EV roaming standard, defines and moves between parties. It is the least glamorous thing in the whole stack and the one that quietly decides whether your money is right or merely plausible. Everything else is a copy of it, or a reaction to it.
What a CDR actually is
The CDR is the closed, final, immutable account of a charging session. Not the live session feed — the settlement document, emitted once the session ends and the numbers are locked.
It carries what billing needs and nothing it can afford to lose:
- start and stop timestamps
- the energy delivered, in kWh
- the tariff that applied and the price elements that fired — per-kWh, per-minute, a session fee, an idle penalty
- the running total and the currency
- the location, the connector, and the token that authorized the session
In a clean pipeline, the CDR is the one place where energy, time, and money are reconciled into a single agreed figure before anyone bills against it.
OCPI gives you the envelope: a defined CDR object, defined fields, a defined way it moves between parties. That standardization is real and it matters. But the envelope is not the discipline. A CDR is only a source of truth if it’s clean, correct, and timely — and those three properties are not in the spec. They live in the pipeline you build around it.
Clean, correct, timely — pick all three or pick disputes
Clean means the CDR is internally consistent. The price elements sum to the total. The energy in the line items matches the energy in the header. The tariff referenced is the tariff that actually applied at the moment of the session, not whatever is current now. A CDR where the parts don’t add up to the whole isn’t a record — it’s an argument waiting to happen.
Correct means it agrees with physical reality and with the money that moved. The kWh on the CDR is the kWh the meter delivered. The total is the total the driver was charged. This is where the gap between the charger and the acquirer goes from theoretical to expensive: the charger, talking to its CSMS over OCPP, knows what it dispensed; the acquirer knows what it captured against the pre-authorization. The CDR sits between them and is supposed to make both stories the same. When it can’t, you have a reconciliation break — and a reconciliation break is just a dispute that hasn’t been filed yet.
Timely means it arrives close enough to the session that the rest of the chain still works. Fiscalization has to happen while the driver is reachable. The unused portion of a pre-authorization hold has to be released before the customer notices it sitting on their statement. And AFIR expects ad-hoc charging to work card-in-hand at an unattended site — and the spirit of that rule is transparent pricing the driver can actually see, which is hard to honour if the settling record shows up days after they’ve walked away.
A CDR that arrives clean and correct but three days late has already broken the receipt and annoyed the cardholder. Latency here is a correctness property, not a performance one.
Miss any one of the three and the CDR stops being a source of truth and becomes a source of tickets.
What the CDR anchors
Walk the dependents, because the dependency is total.
Billing reads the CDR. The amount captured against the pre-authorization should match the CDR total; the strategy you used to size that hold — one fixed amount, incremental re-auth, a driver-declared target — determines whether the capture lands cleanly or needs a partial capture and a refund of the difference. Either way, the CDR is the figure billing settles to. Get it wrong and you’ve either overcharged a customer or eaten the gap.
Fiscalization reads the CDR. A legal receipt isn’t a PDF of the total — it’s a country-specific round trip: the line items and amounts go to the invoicing provider, a fiscal signature comes back, and that signed receipt reaches the driver, often at an unattended terminal by a link. OCPI carries nothing for that round trip; it has to be bridged both ways, per country. And it’s bridged off the CDR. A wrong CDR doesn’t produce a wrong PDF — it produces a legally wrong receipt, the kind the tax office rejects and the kind you can’t quietly fix later.
Disputes are adjudicated against the CDR. When a driver challenges a charge, the CDR — with its timestamps, energy, and itemized price elements — is the evidence. A vague or inconsistent CDR loses the chargeback by default; there’s nothing to point to.
Reconciliation is, in the end, nothing but comparing the CDR to everyone else’s books — the acquirer’s settlement file, the CSMS session log, the fiscal record, your own reporting ledger — and confirming all four tell one story. The CDR is the reference text. If it’s wrong, you’re not reconciling; you’re laundering a bad number through every system and calling the agreement proof.
What breaks when CDRs arrive late, wrong, or missing
The failure modes are dull and entirely predictable.
Late. The receipt misses its window and the driver gets nothing legible while they still care. The unused hold lingers on the card and reads as a phantom charge. Finalization queues up, and reconciliation runs against a moving target.
Wrong. Every downstream copy inherits the error. The receipt is fiscally invalid. The capture over- or under-charges. The dashboard reports revenue that never settled. And because each system trusts the CDR, none of them flags it — they faithfully propagate the mistake until a human notices the money doesn’t add up, usually weeks later, usually in a spreadsheet.
Missing. The worst case, and more common than anyone admits. A session drops mid-charge, the connection between charger and CSMS hiccups, and no CDR is emitted. Energy was delivered, a hold may be sitting on a card, and there is no settlement record at all. Now you’re choosing between charging against a hold with no backing document, or releasing the hold and eating delivered energy. The only honest way out is to reconstruct the session from whatever the OCPP side did manage to report — interim meter values, the last known transaction state — and rebuild a defensible figure before you touch the hold. That reconstruction is real engineering, and OCPI makes none of those decisions for you.
This is precisely the territory the protocol leaves out: the non-happy paths. OCPI defines the CDR object beautifully and says nothing about what to do when that CDR is late, malformed, or never arrives. That silence is exactly where the money leaks.
Why neutrality makes the CDR pipeline harder — and more valuable
If you ran one charger model welded to one terminal and one acquirer, you could paper over a sloppy CDR pipeline with bespoke glue. Real operators don’t. They run multiple charger types across multiple CSMS releases, settling through their own acquirer, in multiple countries — each with its own fiscal round trip, its own VAT treatment, its own idea of what a valid receipt looks like — and they want to swap any of those without rebuilding. Multiply that divergence across a fleet and the per-deployment glue stops being a shortcut and starts being the liability.
That is the case for treating the CDR as infrastructure rather than a per-deployment afterthought. Bolt bridges ad-hoc terminal payments over OCPI so the same discipline applies to any charger, any CSMS, any terminal: ingest the CDR, validate that it’s clean and correct, reconcile it against the acquirer, drive the fiscal round trip, release what wasn’t used, and flag the breaks a human needs to see. The operator stays the merchant; the money settles to their own bank on card-present rails; Bolt never holds the funds. What Bolt holds is the pipeline — the part that makes the CDR worth trusting.
Because every other system in your stack is downstream of that one record. Get the CDR right and they all agree. Get it wrong and you’re not running a payments operation — you’re running four well-formatted guesses and hoping nobody checks.