Append-only event log. Each record carries the hash of its predecessor, so any tampering breaks the chain.
Chain verified. 41,208 events · genesis → head recomputed at 11:45Z · anchored to WORM object storage (compliance-mode object lock) and daily digest published to the regulator data room.
Seq
Timestamp
Actor
Action
Resource
Trace
Hash chain
41213
2026-02-20 11:44:31Z
device:ios-8842
SECURITY_SCREENSHOT_BLOCKED
screen/send-review
a3f7…21c9 → e08c…7b34
41212
2026-02-20 11:44:02Z
device:android-2210
SECURITY_CALL_WARNING
call-guard/whatsapp-group
e08c…7b34 → 4d19…c2a7
41211
2026-02-20 11:43:40Z
svc:device-registry
SECURITY_VPN_BLOCKED
device/android-1077
4d19…c2a7 → 9f60…1e58
41210
2026-02-20 11:43:11Z
svc:device-registry
SECURITY_LOST_MODE_DEREGISTER
device/ios-5521
9f60…1e58 → 2ab4…90fd
41209
2026-02-20 11:42:55Z
web:session-4f2a
SECURITY_SESSION_EVICTED
session/web (older login)
2ab4…90fd → 77c1…d3e6
41208
2026-02-20 11:42:07Z
ml:fraud-scorer@v3.2
ALERT_RAISED
alert/AL-2941
5b1c…88ef → a3f7…21c9
41207
2026-02-20 11:42:06Z
svc:chain-analytics
PROVENANCE_SCORED
deposit/0x8d…4e21
77aa…0d43 → 5b1c…88ef
41206
2026-02-20 11:41:58Z
svc:conversion-engine
CONVERSION_EXECUTED
trade/CV-88213 (USDT→NGN)
c2d9…5f10 → 77aa…0d43
41205
2026-02-20 11:40:12Z
user:ops.amina
CASE_ASSIGNED
alert/AL-2940
90be…7a52 → c2d9…5f10
41204
2026-02-20 11:38:45Z
svc:sanctions-screen
SCREENING_RUN
kyc/KYC-8812
3e44…b6d8 → 90be…7a52
41203
2026-02-20 11:36:20Z
user:mlro.daniel
SAR_SUBMITTED
sar/NCA-2026-0117
f1a2…9c05 → 3e44…b6d8
41202
2026-02-20 11:31:02Z
svc:safeguard-recon
RECON_COMPLETED
safeguarding/daily-2026-02-20
68cd…4417 → f1a2…9c05
41201
2026-02-20 11:29:44Z
regulator:fca.readonly
DASHBOARD_VIEWED
regops/flows?juris=UK
12f0…ee83 → 68cd…4417
One trace ID follows a business event across every layer. The trace above (trc-9f2e11ab) links a P0 provenance score, the P2 conversion it gated, and the alert it raised. Regulator dashboard views are themselves audited (see seq 41201).