Decide on the transaction while it's still in flight.
Payments, fraud, risk and reporting share one property: the value of a decision decays in milliseconds. A batch job that finds fraud at midnight found it after the money left.
Process the flow, not the backlog
Ingest authorization and settlement events as they happen. Deduplicate retries by key, enrich against account state, and route each payment through deterministic rule stages — the obvious ones clear in microseconds, without a model in the path.
Patterns across a window, not a row
Fraud lives in sequences: velocity spikes, split amounts, new-device bursts. Sliding windows with countWhere / sumWhere / stddev score each account in motion — and hand only the ambiguous cases to an LLM stage for a reasoned second look.
A score that's never stale
Keyed, stateful aggregation keeps a live exposure per account, counterparty or desk — updated on every event, queryable at any moment. Keyed timers fire the actions your policy demands: cool-downs, threshold breaches, end-of-window flushes.
Evidence, not spreadsheets
Every decision leaves a trail: per-event trace and trajectory, an audit stream you can subscribe to, and deterministic replay — re-run the exact events behind a flagged decision and show the regulator precisely what the system saw and why it acted.
Why a streaming engine
The primitives banking needs are built in.
Event-time windows
Decisions follow when the transaction happened, not when it arrived. Watermarks keep late events honest; genuinely late ones land in a dead-letter queue instead of silently skewing your numbers.
Exactly-once mindset
Producer-side sequencing and idempotency guards deduplicate retries, so a network blip doesn't become a double charge — and failover recovers with zero data loss on the replicated path.
µs rules before models
Most transactions are decidable by rules and math at microsecond cost. The LLM sees only the residue that genuinely needs judgment — latency and spend stay bounded.
Built for a regulated floor
Your data never leaves your perimeter.
Self-hosted
The engine runs on your infrastructure — on-prem or your cloud. Transaction data never transits a vendor's SaaS.
Durable by quorum
Replicated clusters survive a node loss with no acknowledged event lost — recovery is measured, tested and chaos-verified.
Audit-first
A subscribable audit stream, W3C-standard tracing, and a persisted trajectory for every event that flowed through a decision.
Replayable
Deterministic replay reproduces a past decision byte-for-byte — the difference between "we think" and "we can show you".
What it looks like
A fraud pipeline is one file.
Velocity scoring in a sliding window, rules for the clear cases, an LLM for the gray zone, a case system at the end.
1# pulse.yaml — card-fraud triage
2source:
3 kind: webhook # auth events in
4
5stages:
6 - name: velocity
7 engine: streaming
8 operators:
9 - window: 5m sliding
10 keyBy: card_id
11 aggregations:
12 tx_count: count
13 hi_amount: countWhere(amount > 500)
14 spend: sum(amount)
15
16 - name: triage
17 engine: rule-based
18 rules:
19 - "tx_count > 20 || spend > 10000"
20
21 - name: judge
22 engine: llm
23 systemPrompt: |
24 Given the velocity features, assess
25 fraud likelihood and justify briefly.
26
27sink:
28 kind: webhook # case system / alerting
29 url: ${secret:CASE_WEBHOOK}
30- 1
Scaffold.
pulse new fraud --source webhook --stage streaming:velocity --stage rule-based:triage --stage llm:judge --sink webhook - 2
Tune.
Window sizes, thresholds and the prompt are config — risk owns them without a redeploy cycle through engineering.
- 3
Deploy & observe.
pulse deploy . && pulse events tail --topic fraud.judge.outEvery score, live.
- 4
Prove it later.
Any flagged decision can be replayed deterministically against the exact events that produced it.
Catch it before settlement, not after.
See a fraud pipeline score live events in minutes — no install, no signup. Then self-host on your own floor.
Pulse is free and self-hosted. Multi-node HA, geo-replication and governance come with StreamFlow Enterprise.