A holding crosses a line
A fund's stake in a listed company ticks past five percent. From that moment a clock starts, and within a fixed number of days a specific form has to land with the regulator. Miss it, and the failure is not a typo. It is an enforcement matter, with fines and a public record attached.
This is the kind of problem people reach for AI to solve, and it is exactly the kind of problem where a probabilistic answer is worth nothing. A system that is usually right about whether a filing is due is a system that will, on some percentage of cases, tell you everything is fine while a deadline quietly runs out. In securities, "usually right" is not a feature. It is a liability waiting for its turn.
So look at the problem again, but this time ignore the subject. A fund, a percentage, a regulator, a form. Set all of that aside and watch only the shape underneath. Something measurable crossed a threshold. A named obligation became due. A deadline began to run from the moment of the triggering event. Three moves, and none of them are about securities specifically.
That shape is familiar. It is the same shape as a letter of credit in trade finance, where documents have to be presented within a window that opens the day the goods ship. A measurable event happens. An obligation attaches. A clock starts running toward a hard deadline. The subject could not be more different, a cargo of textiles on one side and an equity stake on the other. The mechanism is the same to the bone.
This is the reason securities is a cheap domain to build rather than an expensive one. The hard parts were already paid for somewhere else, in a domain that has nothing to do with capital markets. You do not build a securities engine. You point an engine you already have at a security master and a threshold table, and it knows what to do.
What is data, and what is a rule
Securities runs on a large amount of reference data, and almost none of it is rules. The universe of instruments and their identifiers. Who issued them. Corporate actions that split, merge, and rename them. Restricted lists and blackout windows. And the per-jurisdiction tables of which threshold triggers which form within how many days. All of this changes constantly, on a schedule set by markets and regulators, not by you. It is maintained reference data, refreshed when the world moves, in exactly the way a sanctions list is refreshed when a new name is designated.
The rules are a thinner, more stable layer that sits on top of that data. When a holding crosses a disclosure threshold, the right filing is due. An order in a restricted instrument is a conduct problem. A position past a venue limit has to be unwound. These are the obligations, and they are different in kind from the data. They are version-controlled. An expert signs off on them. And crucially, they reference the data rather than embedding it. When a regulator changes a threshold percentage, that is a data load. The rule that says "crossing the disclosure threshold makes a filing due" does not change at all. The number it reads changed. The obligation did not.
That separation is what keeps the system maintainable. Tangle the threshold number into the rule logic and every regulatory tweak becomes a code change, reviewed and tested and deployed. Keep them apart and a regulatory tweak is a row update in a table, while the logic stays still.
Here is the disclosure obligation written as a rule, drawn from public US securities law:
{
"rule_id": "SEC-DISC-US-001",
"title": "Beneficial ownership crosses 5%: Schedule 13D due",
"jurisdiction": "us",
"source": "Securities Exchange Act §13(d)",
"severity": "block",
"expected_outcome": {
"action": "review",
"message": "Beneficial ownership of a US-listed equity has crossed 5%. A Schedule 13D is due within the statutory window from the triggering transaction. Confirm filing status and date."
},
"conditions": [
{ "type": "threshold_crossed", "path": "holding.beneficial_ownership_pct", "value": 5.0 },
{ "type": "deadline_window", "from": "holding.threshold_crossed_at", "to": "filing.submitted_at", "max_days": 10 }
],
"deterministic": true,
"validation_status": "expert_reviewed"
}
Two conditions, and you have seen both before in other clothes. The deadline clause is the same evaluator that polices a presentation period under a letter of credit. The threshold clause is the same numeric comparison that polices a capital ratio in banking. Nothing in this rule is new engine work. The only thing that is new is the input it points at: a holding instead of a shipment, an instrument instead of a document, a filing date instead of a presentation date.
Fail closed, here especially
There is a failure mode that matters more in securities than almost anywhere else. Suppose the system cannot resolve an instrument to its canonical identity, because the identifier is malformed or the security master is briefly unreachable. Or suppose it cannot reach the threshold table at all. What should it do?
The wrong answer, the tempting answer, is to let it pass. No verdict, no problem, move on. That is the answer that makes a demo look smooth and a deployment look dangerous, because in a domain where a missed filing is an enforcement action, a quiet "looks fine" is the most expensive thing the system can say. It is precisely the case where you needed it to speak up.
So the engine does the opposite. When it cannot verify the disclosure status, it says so, out loud, and routes the case to a human. "I could not check this" is not a weakness in this domain. It is the only safe answer. A system that cannot admit uncertainty has no business anywhere near a regulator's deadline.
The point
Securities is not a new product bolted onto a trade finance tool. It is the same engine, fed a different kind of reference data, running a deadline check it already knew how to run before securities was ever on the roadmap. That is the whole thesis in one domain. Build the primitive once, in the place where you first genuinely need it, and every domain after that gets cheaper, because the expensive part has already been built and tested somewhere it mattered.
The clock written for a letter of credit was, the entire time, a securities-disclosure engine. It was just waiting for the right input to arrive.