Implementing Event + State Intelligence with Loci

Implementation overview

This brief describes how the recommended event stream plus state snapshot strategy is implemented in practice using Loci's composable infrastructure, and outlines an initial baseline control set suitable for regulatory-grade deployment. It translates the strategy into concrete implementation guidance, while remaining readable to senior technical, risk, and compliance leaders.

The objective is not maximum coverage on day one, but strong baseline controls, explainability and auditability, low operational overhead, and a foundation that can evolve.

Loci implements this strategy by evaluating every transaction as the primary decision event, enriched by two complementary intelligence layers: recent events and current state.

The data model: four logical surfaces

Loci's implementation does not prescribe a rigid schema. Instead, it recommends a minimal, composable data model that supports regulatory-grade controls while keeping operational overhead low.

Every decision in Loci is anchored on a transaction event, enriched by additional data models that provide behavioral and contextual intelligence at decision time. The model is intentionally separated into four logical surfaces, each with a clear responsibility.

entity_events

Purpose: temporal reasoning and sequencing.

entity_state

Purpose: baseline truth at decision time.

entity_facts

Purpose: statistical and behavioral context.

How FLM uses these tables

Every FLM control may read events for recent behavior, read state for eligibility and constraints, and read facts for deviation and pattern detection.

All three are evaluated at transaction time by MADIE, producing a single, explainable decision.

Baseline composable set: the initial 12 controls

The following controls provide broad regulatory coverage while remaining operationally lightweight.

Control categories

Operational implications

• For compliance teams: clear logic, clear intent, and regulator-friendly explanations.
• For engineering teams: stable data models, predictable access patterns, and low change cost.
• For the business: faster time to coverage, lower operational burden, and confidence at scale.

Most importantly: new controls can be added without refactoring data models, and existing controls remain stable as the system evolves.

Phased rollout guidance

Phase 1: foundational coverage (day 0-30)

Establish immediate regulatory-grade protection with low operational risk, high explainability, and minimal tuning. These controls are deterministic, easy to explain to regulators, low false-positive risk, and aligned with baseline AML and fraud expectations.

Phase 1 outcome: strong baseline fraud and AML coverage, immediate regulator confidence, minimal tuning required.

Phase 2: behavioral and network intelligence (day 30-90)

Detect sophisticated, adaptive abuse patterns that emerge after baseline controls are in place. These controls require behavioral baselines, benefit from historical data, and capture patterns missed by simple thresholds.

Phase 2 outcome: coverage of advanced fraud and AML typologies, reduced blind spots, improved detection of organized or evolving abuse.

Why phased deployment matters

This rollout strategy avoids early false-positive fatigue, allows data to accumulate naturally, gives teams time to build confidence, and aligns with how regulators expect controls to mature.

It also reinforces Loci's core principle: intelligence should grow with the organization.

Closing

This approach does not attempt to predict every fraud pattern. Instead, it provides a clean intelligence foundation, a regulator-aligned reasoning model, and a scalable path forward.

With Loci, fraud and AML controls become structured intelligence, not accumulated complexity.