Fraud Detection

The day-one work of every AML / financial-crime analyst — done in one pass. Paste a list of wire transactions (sender, beneficiary, country, amount, currency, date/time, purpose), and one structured-output call surfaces the patterns experts actually look for: structuring under reporting thresholds, layering through tax havens, BEC indicators (test wire + sudden new beneficiary), high-risk jurisdictions on FATF lists, shell-entity signals, after-hours timing, velocity anomalies, round-number bias, and vague wire purposes. Each flagged transaction gets a risk score, named flags, a rationale, and a recommended action — approve, hold, escalate to AML, or block-and-SAR.

// TRANSACTION DATASET · one wire per line 0 transactions

Suggested format (one txn per line):

TXN-ID | YYYY-MM-DD HH:MM | Sender | Sender Country | Beneficiary | Beneficiary Country | Amount | Currency | Purpose | Channel

— but the model is forgiving; CSV, JSON-lines, or other shapes work too.

paste at least 5 transactions or pick a preset

Detected patterns —

Flagged transactions · sorted by risk score —

Counterparty risk —

Geographic concentration —

Regulatory recommendations —

Worth knowing

Architecture — what just happened

Browser
  └─→ POST /api/lab/chat
        - system: AML pattern-taxonomy prompt with the
                  schema below (versioned: fraud-detection.v1)
        - user: the raw transaction dataset
        - temperature: 0.2 (low — risk decisions must be stable)
        - max_tokens: 3500
        ← single response, parsed as JSON: {
            summary, total_transactions, total_volume_usd,
            transactions_flagged, risk_distribution,
            flagged_transactions[], patterns_detected[],
            entity_risk_assessment[], geographic_concentration[],
            regulatory_recommendations[], executive_summary,
            warnings[]
          }
        ← rendered as: executive summary card + risk
          distribution bar + patterns list (sorted by severity)
          + flagged transactions (sorted by risk score) +
          counterparty risk + geo concentration with FATF
          status + regulatory action items + warnings

One LLM call covering the full pattern taxonomy that financial-crime analysts use day-to-day: structuring, layering, BEC indicators, high-risk jurisdictions, shell entity signals, after-hours timing, velocity anomalies, round-number bias, vague wire purposes. Every flagged transaction includes a regulatory citation (BSA / AML, FATF Recommendation 16, OFAC, EU AMLD6) so the analyst can route to the right downstream control.

Why this matters for compliance, AML, and bank ops

Tier-1 banks process millions of wires per day. The first line of defense — transaction monitoring — is famously false-positive-heavy: traditional rule-based systems flag 2-5% of transactions, of which 95-99% are noise. AML analysts spend their day clearing alerts, not investigating real fraud. The pattern taxonomy is well-known but mechanical to apply at scale.

This demo collapses the pattern-recognition pass. Drop a transaction batch in, get back the same structured screening output a senior analyst would produce — with the regulatory citation already attached to each finding. The analyst still owns the SAR / no-SAR decision (and that's the point — the model is a force multiplier, not a substitute), but they start from a populated investigation file rather than a stack of raw alerts.

Same shape works for: card fraud screening, AML alert triage, SAR drafting (output becomes the narrative), correspondent-banking due diligence, and trade-finance compliance.

Honest caveat: the model's training-cutoff knowledge of FATF lists, sanctioned entities, and PEP databases is stale. In production, this layer would be augmented with current authoritative data sources (OFAC SDN list, FATF grey/ black list, World-Check). Treat the output as pattern detection, not compliance signoff. Every real SAR decision goes through a human analyst with current authoritative data.

Telemetry — request, response, parsed structure

Run an analysis to see telemetry.