Home > Docs > Industries > Financial Services

🏦 Financial Services — Fraud Detection & Risk Analytics¶

Last Updated: 2026-05-05 | Version: 1.0.0

"Financial institutions process billions of transactions daily — detecting the fraudulent ones in real time is not optional, it is existential."

📑 Table of Contents¶

• Scenario Overview
• Regulatory Landscape
• Data Flow Architecture
• Why Fabric for Financial Services
• Getting Started
• References

🎯 Scenario Overview¶

📋 Regulatory Landscape¶

🏗️ Data Flow Architecture¶

flowchart LR
    subgraph Sources["🏦 Data Sources"]
        CORE["Core Banking<br/>System"]
        CARD["Card Processing<br/>Network"]
        MKT["Market Data<br/>Feeds"]
        CRM["CRM / Wealth<br/>Platform"]
        REG["Regulatory<br/>Reporting DB"]
    end

    subgraph Bronze["🥉 Bronze Layer"]
        B1["Transaction Logs<br/>(append-only)"]
        B2["Card Auth Events<br/>(Eventstream)"]
        B3["Market Tick Data<br/>(Eventstream)"]
        B4["Customer Records<br/>(CDC → Delta)"]
    end

    subgraph Silver["🥈 Silver Layer"]
        S1["Transactions<br/>(deduplicated, PAN masked)"]
        S2["Customer Master<br/>(KYC verified)"]
        S3["Market OHLCV<br/>(validated)"]
        S4["Account Positions<br/>(reconciled)"]
    end

    subgraph Gold["🥇 Gold Layer"]
        G1["Fraud Scoring<br/>Feature Store"]
        G2["Regulatory<br/>Capital Aggregates"]
        G3["Customer 360<br/>Star Schema"]
        G4["AML Transaction<br/>Graph"]
    end

    subgraph BI["📊 Consumption"]
        EVH["Eventhouse<br/>(real-time queries)"]
        DL["Direct Lake<br/>Semantic Model"]
        PBI["Power BI<br/>Dashboards"]
        DA["Data Activator<br/>Fraud Alerts"]
    end

    CORE --> B1
    CARD --> B2
    MKT --> B3
    CRM --> B4
    REG --> B1

    B1 --> S1
    B2 --> S1
    B3 --> S3
    B4 --> S2

    S1 --> G1
    S1 --> G4
    S2 --> G3
    S3 --> G1
    S1 --> G2
    S4 --> G2

    G1 --> EVH --> DA
    G2 --> DL --> PBI
    G3 --> DL
    B2 --> EVH

💡 Why Fabric for Financial Services¶

Sub-second fraud detection without separate streaming infrastructure. Card authorization events flow through Eventstreams directly into Eventhouse, where KQL anomaly detection functions identify suspicious patterns and Data Activator blocks transactions — all within Fabric, no external Kafka or Flink clusters needed.

Auditable, immutable data lineage. Delta Lake's transaction log and time-travel capabilities provide the versioned, tamper-evident data history that SOX and Basel auditors require. Combined with SQL Audit Logs, every data access is traceable.

Single platform for batch and real-time. Financial institutions typically run nightly risk calculations alongside real-time fraud monitoring. Fabric unifies both in one workspace — Lakehouse for batch, Eventhouse for streaming — reading from the same OneLake storage.

PCI-DSS controls built in. Column-level security masks PANs and CVVs, customer-managed keys provide BYOK encryption, and managed private endpoints ensure card data never traverses public networks.

Regulatory reporting without data movement. Direct Lake semantic models over Warehouse star schemas give risk and compliance teams self-service access to regulatory capital, liquidity, and leverage dashboards without exporting data to external BI tools.

🚀 Getting Started¶

1. Set up the medallion architecture — Follow Tutorial 01: Bronze Ingestion and Medallion Deep Dive to establish Bronze/Silver/Gold layers.
2. Stream transaction events — Configure Eventstreams to ingest card authorization events from Event Hub into Eventhouse.
3. Apply PCI-DSS controls — Enable OneLake Security CLS for PAN masking, CMK, and Network Security private endpoints.
4. Build fraud detection — Use Eventhouse KQL anomaly detection on the transaction stream and wire Data Activator alerts.
5. Create regulatory reports — Build Warehouse aggregation tables and connect Direct Lake for Basel/SOX dashboards.
6. Deploy credit risk models — Train and deploy scoring models via AutoML on Gold-layer feature tables.

📚 References¶