Enterprises operating in regulated sectors face a widening gap between the speed at which business events occur and the speed at which compliance functions can observe, assess, and act on those events. Batch-oriented control frameworks, built around nightly extracts, monthly reconciliations, and periodic attestations, were designed for an era in which the underlying transactions themselves settled slowly. That assumption no longer holds. Instant payments, algorithmic trading, continuous deployment, distributed data platforms, and always-on customer channels have compressed the window in which a control can be preventive rather than merely forensic.
This paper reviews the emerging class of systems that close that gap, which we refer to collectively as real-time compliance pipelines: streaming data architectures that embed regulatory logic, risk analytics, and governance controls directly into the operational data path. We synthesize literature and practice published up to and including 2022 across four normally separate communities: stream processing systems research, financial crime and risk analytics, data governance and metadata management, and privacy engineering. From this synthesis we derive a seven-layer reference architecture, a taxonomy of detection strategies spanning deterministic rules through graph and machine learning methods, and an evaluation framework covering latency, detection quality, governance coverage, and cost.
Our principal finding is that the technical substrate for real-time compliance is largely mature, while the governance substrate is not. Event streaming platforms, exactly-once processing semantics, policy-as-code engines, and open lineage standards are all production-viable. What remains unresolved is the semantic problem: translating natural-language regulatory obligations into executable, testable, auditable, and versioned artifacts whose behavior can be defended to a supervisor years after the fact. We identify eight research gaps, including regulatory intent representation, evidence-preserving reprocessing, model risk governance for streaming detection models, and the unresolved tension between privacy minimization mandates and surveillance obligations.