I believe the major players (Visa being one of them, and I know a Visa engineer) use formal verification for the actual money-handling code. Obviously, yeah, there could be mistakes with the verifier, etc, but the problems they experience are relegated to the "couldn't do this transaction" variety, rather than the "we did this transaction wrong" variety.