The Institutional Challenge: T+1 Punishes Manual Architecture
The settlement clock is now the design constraint for the entire back office.
The window collapsed. The US, Canada, Mexico and Argentina moved to T+1 in May 2024; the UK, EU/EEA and Switzerland have mandated 11 October 2027. Trade-date compression leaves hours, not overnight batches, to detect, route and resolve trade breaks before they cascade into fails, penalties and client claims.
Manual processes cannot evidence themselves. HKMA's OR-2 module requires authorised institutions to demonstrate robust, repeatable controls that remain effective under stress, and HKMA confirmed in May 2026 that all AIs completed the OR-2 implementation journey. A process living in an analyst's inbox or an unlocked spreadsheet fails that test regardless of outcome quality.
Change management without control. T+1 cutover logic, exception thresholds and routing rules buried in code or macros are slow, risky and opaque to change. Regulators increasingly expect firms to prove the controls existed before the event, versioned, tested and approved.
Onboarding drags revenue. Institutional counterparty onboarding and KYC remain labour-intensive across five or more systems, injecting conduct risk into what should be a deterministic, auditable process and delaying time-to-trade.
Reference Architecture: The Process Is the Audit Trail
The design principle: model the operation as executable process flows, encode the judgment as inspectable DMN, and let the engine generate the evidence.
Ingestion & Orchestration: The Executable Process Spine
Every operational event, trade capture, affirmation status, SSI confirmation, settlement instruction, reconciliation break, instantiates or signals an executable process on the orchestration engine under a unique business key. Idempotency is enforced at the process level: settlement retries and message replays cannot produce duplicate instructions, duplicate payments or duplicate client notifications. Process error events and compensation handlers ensure a failed downstream call triggers a defined, auditable recovery path rather than silent data loss. SLA timers count down against T+1 deadlines; escalation is a modeled branch, not a hoped-for behaviour. Long-running case-management patterns, validated in published large-bank orchestration deployments, cover investigations and disputes that outlive the settlement date.
Walkthrough, an SSI mismatch on trade date, 18:40 HKT:
Detection. The Harmony Engine's exception-awareness layer flags a standing-settlement-instruction mismatch on a USD equity block; the reconciliation event signals the running settle-and-reconcile instance.
Classification. A DMN decision table scores the break: instrument class, counterparty risk tier, break age, value, T+1 cutover proximity. Output: critical, route to senior operations, freeze auto-retry, open client-notification branch.
Routing. The orchestration engine spawns a case task with a two-hour SLA; the agentic layer assembles context, trade history with this counterparty, prior SSI changes, the document trail, and InvestLM drafts the escalation summary with citations to the operations manual.
Resolution and compensation. The corrected SSI is applied; the process resumes from the exact failure point via compensation handlers, no duplicate settlement instruction is emitted.
Evidence. The instance closes with a complete record: what broke, when, which rule version classified it, who acted, and whether the SLA held.
Decision Engine (DMN): Business-Owned Rules at Market Speed
T+1 cutover logic, break-routing rules, risk-approval scoring and exception thresholds live in FEEL decision tables that business analysts read in the visual process modeler, simulate against historical trade populations, and promote through a versioned four-eyes gate, without touching code. Rule changes ship in days, not release cycles, and every change is back-tested before production. This is "process engineers, not developers": the people who own the business rule own its technical implementation.
Human-in-the-Loop & Auditability
Orchestration does not remove humans; it removes humans from the wrong places. Deterministic flows run straight through with a complete evidence trail; judgment-bearing branches, high-value exceptions, client-impacting decisions, route to named roles under SLA tracking. Every step, branch and compensation event is recorded by the engine and replayable for internal audit, the HKMA or the SFC on first request.
Empirical Baselines & Regulatory Alignment
Capability | Published baseline | Source |
|---|---|---|
Post-trade orchestration migration | ~40% fewer operational incidents in analogous orchestration migrations | AI Services reference implementations; published process-orchestration case studies |
Rule-change cycle time | Days instead of release cycles for T+1 cutover and exception-routing logic | DMN versioning + four-eyes promotion pattern |
Audit readiness | End-of-period reconstruction replaced by real-time, per-instance evidence | Orchestration engine process records |
Regulatory alignment by design:
HKMA SPM OR-2 (Operational Resilience), critical-operation mapping, tolerances for disruption, scenario-tested incident handling: the orchestrated process inventory is the dependency map OR-2 asks institutions to maintain, and the engine's records evidence repeatable controls under stress.
SFC Type 9 and securities-reporting obligations, deterministic, versioned pre-trade and post-trade decision logic with complete lineage.
T+1 market practice (US May 2024; UK/EU/CH October 2027), cutover logic encoded as inspectable DMN, changeable at market speed as further jurisdictions compress.
PDPO (Cap. 486), data minimisation and purpose-bound handling across the onboard, KYC, settle, reconcile, report lifecycle.
The Global Scaling Implication
Post-trade is the entry point, not the ceiling. The same orchestration spine and DMN decisioning patterns extend to regulatory reporting, AI guardrails and KYC without new infrastructure, the same architecture deployed again with a different rule set. Firms that industrialise T+1 on this fabric find the operational benefit compounds across the function: every adjacent workflow becomes a re-use of versioned, auditable patterns, and the institution's resilience posture stops being a programme and becomes a property of the platform.
FAQ
Q: How does the orchestration layer prevent duplicate settlement instructions when downstream systems retry or replay messages?
A: Idempotency is enforced at the process level through unique business keys on every process instance. A retried message maps to the same key and rejoins the existing instance instead of spawning a duplicate; process compensation handlers define the exact reversal and recovery path for any partially completed sequence. The safety property is structural, it does not depend on each downstream microservice being idempotent itself.
Q: How does this architecture evidence operational resilience to HKMA under OR-2?
A: Three ways, all generated rather than assembled. First, the modeled process inventory doubles as the critical-operations dependency map, people, processes, technology and information are explicit in the process models. Second, SLA timers, escalation branches and compensation handlers are the documented, executable incident-management controls, testable under severe-but-plausible scenarios by simulating the process itself. Third, every process instance produces a timestamped, replayable record, so "demonstrate that your controls operated during the disruption" is a query, not a project.
