You create a state machine. Create the order, and set the status to pending. Keep checking the web service until it allows the transaction. Set the status to a

You create a state machine. Create the order, and set the status to pending. Keep checking the web service until it allows the transaction. Set the status to authorized and set the status to payment. Keep trying the payment until it succeeds, officially set the order and set status to ordered. I really find it hard to believe that the regulations won't allow you to check the web service for authorization before creating the order. If that's really the case then create the order and check, and if it doesn't work, then cancel the status of the order and retry. It's only a few rows in the database. If this happens often then show the data to your local politician or what not and tell them they need to add more flexibility to the regulation.