The Institutional Challenge: Compliance Volume Has Outgrown Rules-Based Architecture

The operating model of compliance has inverted. What was a throughput problem is now an evidence problem, and legacy stacks solve neither.

• Alert factories, not controls. Static rules engines produce false-positive rates of 90-95% across published industry research. Investigators spend the majority of their capacity proving that risk is absent rather than interdicting risk that is present. Meanwhile, typologies, authorised push-payment fraud, mule networks, layered UBO structures, mutate weekly, and rules do not.

• Regulators now grade the reasoning, not just the result. HKMA’s circular on Consumer Protection in respect of Use of Generative Artificial Intelligence (19 August 2024) requires authorised institutions to offer human intervention and opt-out mechanisms, continuously monitor GenAI output, and retain board-level accountability. The EU AI Act has made explainability a global benchmark that Hong Kong subsidiaries of international banks must meet regardless of local law.

• Entity fragmentation defeats account-level checks. The same beneficial owner surfaces under dozens of name variants across KYC, CRM and core banking. Flat sanctions lists cannot traverse multi-hop corporate structures, the sanctioned party who owns the holding company that owns the counterparty is invisible to a two-dimensional screen.

• Audit is still reconstructed after the fact. Under HKMA SPM module OR-2 (Operational Resilience), institutions must demonstrate robust, repeatable controls that hold under stress, and HKMA confirmed in May 2026 that all authorised institutions have now completed the OR-2 implementation journey. A process that lives in email and spreadsheets cannot produce that evidence on demand.

The gap is architectural. Institutions do not need another point solution; they need a decisioning layer that is deterministic where the rules are known, probabilistic where judgment adds value, and auditable everywhere.

Reference Architecture: The Feelistic Decisioning Fabric

The fabric separates what must be certain (rules) from what must be learned (patterns), and welds them to a process engine that records everything. Four layers, each with a distinct contract.

Ingestion & Orchestration: Executable Process Infrastructure

Every compliance event, an ISO 20022 payment message, a KYC document pack, a sanctions-list update, a regulatory circular, enters as an event that instantiates an executable process on the orchestration engine under a unique business key. That key enforces idempotency: settlement retries, message replays and partial updates cannot produce duplicate payments, duplicate alerts or duplicate filings. SLA timers, escalation paths, compensation handlers and case-management branches are modelled visually in the process itself. The audit trail is not paperwork after the fact; with executable process models, the audit trail is the process.

Walkthrough, a USD 50,000 cross-border wire, Hong Kong to Singapore:

1. T+0ms, Ingestion. The payment instruction hits the event bus. The orchestration engine starts a cross-border-payment-vetting instance; the business key guarantees this exact instruction can never be processed twice.

2. T+80ms, Enrichment. The Harmony Intelligence Engine scores the instruction in flight: transaction velocity against the customer’s declared profile, account-age signals, counterparty network risk. In parallel, it issues multi-hop UBO traversal as SPARQL queries against the institution’s knowledge graph, a FIBO-inspired RDF/OWL ontology extended with HKMA, MAS and Mainland regulatory concepts.

3. T+150ms, The graph finds what a list cannot. The Singapore counterparty resolves, through two ownership hops, to a holding vehicle with exposure to a FATF grey-list jurisdiction. Predictive risk propagation raises the counterparty’s effective risk score; graph embeddings surface the counterparties three hops out that flat-file screening would have cleared.

4. T+200ms, Deterministic decisioning. An Executable DMN decision table, written in FEEL, readable by a compliance analyst, version-controlled and back-testable before promotion, evaluates the enriched picture: hard gates (sanctions match, block), jurisdiction multipliers, velocity thresholds, propagated network risk. Output: route to enhanced due diligence, not straight-through processing.

5. T+seconds, Grounded explanation. InvestLM-Enterprise Compliance, retrieval-augmented over HKMA circulars and internal policy, drafts the analyst-ready summary: the graph path, the three-to-five SHAP/LIME feature drivers, the source citations. Confidence below threshold? The passage is flagged rather than included.

6. Human gate. A case-management task with an SLA countdown lands with a designated reviewer. Approval or decline is captured, who, when, against which version of which rule, in the engine’s own log.

Decision Engine (DMN): Deterministic Where It Must Be, Probabilistic Where It Pays

The architectural discipline is the boundary between the two. DMN decision tables own the deterministic perimeter: hard gates, thresholds, routing rules, materiality tests, encoded in FEEL, simulated against historical populations in the visual process modeler, promoted through a four-eyes approval gate, and updated by business owners in days rather than release cycles. The Harmony Engine owns the probabilistic interior: ML-ranked alert triage, behavioural velocity scoring, dynamic knowledge-graph traversal, drift monitoring and bias checks. InvestLM grounds every narrative output in retrievable sources, materially reducing hallucination relative to general-purpose models. A probabilistic score can route a case; only a versioned DMN rule can decide it. That separation is what makes the fabric defensible under examination.

Human-in-the-Loop & Auditability

HITL is engineered as a routing branch, not a policy memo. Low-risk volume flows straight through with a complete evidence trail; elevated risk lands with a human under SLA tracking; the highest-risk composite scores force a specialist panel before any activation. Every layer logs by construction, the orchestration engine’s process record, the DMN rule version, the graph traversal path, the InvestLM citation chain. The institution answers “why was this entity flagged?” with a re-runnable query, not a reconstruction exercise.

Empirical Baselines & Regulatory Alignment

Reference architectures earn credibility only against published baselines. The evidence bridge for this fabric:

Regulatory alignment is a design input, not a retrofit:

• HKMA GenAI circular (19 Aug 2024), human intervention, opt-out, continuous output monitoring and board accountability are implemented as workflow gates and monitoring loops, not documentation.

• HKMA High-level Principles on AI (Nov 2019), governance, transparency and explainability are satisfied structurally: every AI-assisted decision carries a traceable chain from data to rule to rationale.

• HKMA SPM OR-2, idempotent, SLA-tracked, compensation-handled processes are the demonstrable, repeatable controls OR-2 expects; the fabric produces the mapping and dependency evidence examination teams request.

• SFC GenAI language-model circular (Nov 2024), high-risk use cases (advice, recommendation, research) route through mandatory human-in-the-loop review before any output is actioned.

• PDPO (Cap. 486) and PCPD’s Model Personal Data Protection Framework (2024), data minimisation and purpose limitation are embedded in the retrieval and scoring layers by design.

• MAS FEAT principles / Veritas, NIST AI RMF 1.0, EU AI Act, fairness assessment, model documentation and explainability benchmarks map onto the same evidence artefacts the fabric already produces.

The Global Scaling Implication

Each deployment of the fabric makes the next one cheaper. The FIBO-inspired ontology built for KYC entity resolution is the same graph that powers sanctions screening, alert enrichment, counterparty exposure analysis and regulatory reporting. The DMN patterns proven in post-trade T+1 orchestration are re-used in reporting materiality rules and guardrail thresholds. The InvestLM grounding tuned on HKMA circulars accepts MAS and PBOC overlays on a single backbone. This is the compounding dynamic: the eighth use case costs a fraction of the first because it is a re-use of the same architecture, not a greenfield project. An institution that localises one compliance pain point on this fabric is, in fact, building the enterprise decisioning moat, a governed, explainable, cross-jurisdictional layer that converts regulatory pressure from a recurring cost into a durable operational advantage.

FAQ

Q: How does the decisioning fabric integrate with an existing core banking stack, is this a rip-and-replace programme?

A: No. The fabric deploys as an event-driven layer alongside the core. The orchestration engine consumes payment and KYC events (ISO 20022 messages, document-pack arrivals, list updates) through connectors; DMN decision services are invoked over REST/gRPC; the knowledge graph reads from the existing data lake or warehouse. The core ledger is untouched. Idempotency keys at the process level make the overlay safe to retry and replay, so institutions typically pilot on one flow, cross-border wire vetting or alert triage, and extend by adding rule sets, not infrastructure.

Q: How does the architecture satisfy HKMA’s 2024 GenAI circular on human oversight without sacrificing straight-through processing?

A: By making human oversight a risk-routed branch rather than a universal gate. Deterministic DMN tables decide which cases are eligible for straight-through processing; only cases crossing defined risk thresholds, or any customer-facing GenAI output, route to a human reviewer under SLA tracking, directly implementing the circular’s human-intervention and opt-out requirements. Every automated decision still produces a complete evidence trail (rule version, graph path, citation chain, confidence score), so the institution demonstrates continuous monitoring and explainability on 100% of volume while spending human judgement only where the risk warrants it.