Monitoring that explains itself.

8 scenarios, tuned per client

Structuring, velocity, high-risk jurisdiction, large cash, amount anomaly against a customer’s own baseline, dormant reactivation, round-dollar patterns, and rapid pass-through. Each rule is a pure function over one transaction and the originator’s prior activity, so the same inputs always give the same answer.

• Round-dollar amountsFFIEC BSA/AML Examination Manual — unusual transaction patterns
• High-risk jurisdiction31 CFR 1010.610; FATF high-risk jurisdictions statement
• Structuring31 USC 5324; 31 CFR 1010.311 (CTR threshold)
• Transaction velocityFFIEC BSA/AML Examination Manual — funds transfer monitoring
• Large cash transaction31 CFR 1010.311 — Currency Transaction Report
• Amount anomaly vs. baselineFFIEC BSA/AML Examination Manual — customer activity review
• Dormant account reactivationFinCEN advisories on account takeover and money mule activity
• Rapid pass-throughFinCEN advisory FIN-2014-A005 — funnel accounts

OFAC, with the false positives taken seriously

Both parties are screened at ingestion against the loaded watchlists. Names are compared order-insensitively, because payment messages and sanctions lists disagree constantly about name order and middle names.

Token weights come from the list itself, so a shared “group” or “trading” counts for almost nothing and a rare name is decisive. A hit raises an alert regardless of score — screening is strict liability, not a judgement call.

The SAR clock starts at detection

A case carries a 30-day deadline running from the earliest linked alert, not from the day somebody opened it. Closing a case closes its alerts — an alert left open under a closed case is exactly the gap an examiner looks for.