My queue

Sorted by risk

A-1042 · Scenario TM-07 v4.2 · Rapid in-and-out

Example Trading GmbH

Corporate · Wholesale trade · Frankfurt · Customer since Sep 2026

3 monitoring alerts1 screening hit pendingUBO changed 01 Oct

🔒 Risk score hidden

Shown after you save your initial view, so the model does not set your starting point.

Calibration in force

Research

RuleTM-07 v4.2 · Rapid in-and-out

Alert thresholdScore ≥ 70

Lookback30 days, evaluated nightly

Set byFCC model governance, 02 Sep 2026

Approved byMLRO

Recorded basisBack-test on 2025 data; target escalation rate 5%

The pattern began on 22 Sep. The score first crossed 70 on 13 Oct, 21 days later. That delay was set by these values, not by any analyst.

This alert's distance from the threshold is shown with the score, after your initial view.

What the data shows

Inflows 4.1× the peer-group median over 30 daysAccount history

82% of funds leave within 48 hours of arrivalPayments, 22 Sep – 06 Oct

Six new counterparties in a higher-risk corridorCounterparty records

Account volume 4× the turnover declared at onboardingKYC file

Facts only. How much each one moved the score is shown with the score, after your initial view.

Last 30 days

InflowsOutflows

14 Sep22 Sep · pattern starts13 Oct

Transactions behind the alert

Date	Direction	Counterparty	Country	Amount (EUR)
2026-09-22	In	Orion Commodities Ltd	AE	412,000
2026-09-23	Out	Meridian Holdings SA	CY	398,000
2026-09-29	In	Orion Commodities Ltd	AE	505,000
2026-09-30	Out	Baltic Trade Partners OÜ	EE	497,000
2026-10-06	In	Sunrise Metals FZE	AE	460,000

Your assessment

Initial view, before any suggestion

Likely explained by business Needs investigation Rationale in your own words (required)

🔒 Copilot suggestion

Score, score drivers and the copilot view are revealed together once you save your initial view. This case is in the blind-first sample.

Information request

Ask the customer for invoices and contracts for two inbound transfers.

✓ Tipping-off check passed

Your decision, rationale and the versions used are recorded and can be replayed by QA and audit.

CASE-2026-0417 · opened 13 Oct from A-1042 · escalated by L1

Example Trading GmbH

High riskStage: L2 investigationSLA: 6 working days left

Overview Network Transactions Evidence (12)Customer file History

Ownership and payment network

OwnershipPayments · width = amountUnconfirmed match

Ownership structure as at 13 Oct 2026, snapshotted with this case. Line width is proportional to value; dates show when each flow moved. Hover a node to isolate it; click Orion to open the counterparty view.

Transactions

Date	Direction	Counterparty	Country	Amount (EUR)	Within 48h
2026-09-22	In	Orion Commodities Ltd	AE	412,000	—
2026-09-23	Out	Meridian Holdings SA	CY	398,000	Yes · 26 h
2026-09-29	In	Orion Commodities Ltd	AE	505,000	—
2026-09-30	Out	Baltic Trade Partners OÜ	EE	497,000	Yes · 22 h
2026-10-06	In	Sunrise Metals FZE	AE	460,000	—
2026-10-07	Out	Meridian Holdings SA	CY	444,500	Yes · 31 h

Evidence locker

ID	Item	Source	Fingerprint
E-01	KYC file and risk rating at onboarding	KYC system	9f2c…a1e4
E-03	Payment messages, 22 Sep – 06 Oct	Payments hub	41bd…07c2
E-05	Invoice set supplied by customer	RFI reply	c83a…55f0
E-07	Counterparty registry extracts	Public registers	7e10…d9b3
E-09	Industry note: commodity settlement cycles	Research desk	5a71…c0d2
E-10	Filed accounts, three counterparties	Public registers	e04b…8f31
E-11	Screening hit record, director	Screening	2a6f…3c88

Point of suspicion

Research

Not yet recorded. Record the moment you suspect, and the evidence you rely on. The time is sealed when you save and cannot be back-dated.

Evidence relied on

E-03 Payment messages E-05 Invoice set E-07 Registry extracts E-11 Screening hit, director

Pattern began22 Sep

Alert raised (TM-07)13 Oct 06:04

Escalated by L113 Oct 09:21

Suspicion formednot yet

Saving starts the internal "without delay" clock to filing.

Hypotheses

Pass-through for a third partyOpen

Supports: E-03, E-07 · Against: none yet

Trade-based layeringOpen

Supports: E-05 · Against: E-09

Seasonal trade cycleRuled out

No prior-year pattern; customer since Sep 2026 (E-01)

Timeline

03 SepAccount opened; CDD completed, medium risk 22 SepFirst inbound transfer, €412k from AE 23 SepOutbound €398k to CY, next day 01 OctDirector name hit raised by screening 13 OctAlert A-1042 escalated by L1

Facts that cut the other way

Required before the case can go to QA.

Declared business is commodity trading, where fast back-to-back flows are normal (E-09).
Counterparties are registered companies with filed accounts (E-10).
Director match is on name and birth year only; no confirmation yet (E-11).

CASE-2026-0417 · Example Trading GmbH · FIU Germany (goAML)

Suspicious activity report

Draft · awaiting your decisionRecommended by L2 on 14 Oct · QA approved

Research Suspicion formed 14 Oct 09:50 · L2 investigator · on E-03, E-05, E-07 Time since 23 h 40 min Internal target file within 24 h · 20 min left

Grounds for suspicion

Drafted by copilot · edited by L2 1 sentence without evidence

WHO

Example Trading GmbH, Frankfurt, a wholesale trading company and customer since 3 September 2026, wholly owned by Brandt Holding GmbH E-01

WHAT AND WHEN

Between 22 September and 6 October 2026 the account received €1.38m in three transfers from two companies in the United Arab Emirates E-03. In each case, at least 96% of the amount was sent on within 48 hours to companies in Cyprus and Estonia E-03 E-07.

WHY IT IS SUSPICIOUS

The invoices supplied describe goods that do not match the declared business and carry no shipping documents E-05. The pattern is typical of companies used solely to move funds for others.

Highlighted sentence has no evidence. Cite an item or remove it; uncited text cannot be submitted.

CONSIDERED AND WEIGHED

Fast back-to-back flows are common in commodity trading E-09, and the counterparties file accounts E-10. Neither explains the absence of shipping documents.

Your decision

File report with the FIU Do not file; record reasons Rationale (required)

Before submission

✓Four-eyes review: QA approved on 14 Oct

✓goAML schema valid; 38 of 38 mandatory fields complete

✓Attachments fingerprinted and stored with the case

!Every sentence cites evidence: 1 open

✓Evidence against recorded and addressed

✓Point of suspicion recorded and sealed: 14 Oct 09:50

Applies automatically after filing

Transaction hold

P-88290 · €212,000 to Meridian Holdings SA · three working days, Hesse calendar · ends Tue 20 Oct, 24:00 unless the FIU consents earlier

Tipping-off lock

1st line cannot see the report; customer messages pass a disclosure check

Enhanced monitoring

Customer moved to high-risk segment; review in 90 days

CASE-2026-0417 · Example Trading GmbH · filed 15 Oct 2026

Decision replay

Show what was known as at

Suspicion timeline

Research

22 Sep

Pattern begins

Customer behaviour

21 days

set by calibration

13 Oct 06:04

Alert raised

TM-07 v4.2

3 h 17 min

L1 review

13 Oct 09:21

Escalated

L1 analyst

24 h 29 min

investigation

14 Oct 09:50

Suspicion formed

L2 investigator

23 h 52 min

QA and MLRO

15 Oct 09:42

Report filed

MLRO

Each moment is sealed in the log. The first gap was decided by the rule's threshold and lookback; the others by named people. Which of these moments the duty to report attaches to is the open legal question.

Event log

✓ Hash chain intact · 41 events

Time	Actor	Event	Versions in force

Snapshot · filing decision

Decided by

MLRO, named user

Outcome

File report

Evidence relied on

E-03, E-05, E-07

Evidence against

E-09, E-10, E-11

Copilot shown

Yes, after L2 view

Four-eyes

QA, 14 Oct

Suspicion formed

14 Oct 09:50 · L2

Suspicion to filing

23 h 52 min

Snapshot fingerprintd41e…9b07

IntegrityVerified

Nightly recomputationMatches

Known on 13 Oct vs today

Field	13 Oct	Today

Live queue

Payments waiting: 6

F-2210 · SEPA credit transfer · held for review at 09:41:18

€18,400.00 to a new payee

From retail customer M. Keller (age band 70+) to "J. Becker", IBAN at another EU bank

Fraud score

91

High · model F-3.1

Signals

Payee name check: no matchAccount holder name differs from "J. Becker"

Remote-access app activeDetected during the session

Amount 9× usual maximumLargest transfer in 24 months: €2,050

Long call before loginCustomer on a phone call during session

Act before the timer runs out

If no decision is made in time, the payment stays held and the customer is called back. It is never released automatically.

Linked to AML

The same payee account received money from 4 other customers this week, each sent on within hours.

Possible money mule

Fraud and AML keep separate queues and decisions; the case, entity and evidence are shared.

Today

Payments held23

Released after call17

Confirmed fraud prevented€46,300

Recall requests sent2

Rules live

64

3 in challenger, 2 in validation

Typologies covered

41 of 48

7 without a rule

Rules drifting

3

Customer base has shifted

Detection checks today

64 of 64

All canaries alerted

Rules, last 90 days · 7 of 64 shown

Conversion is a diagnostic, never a target

Rule	Typology	Alerts	To case	To report	QA overturned	Status

TM-07 · why it is drifting

Wholesale trading customers grew 38% since the rule was tuned. Alerts rose, but most new alerts close as normal trading flows.

MayOct

Proposed change

Separate threshold for the wholesale-trade segment. Below-the-line test on 3 months: 31% fewer alerts, all 14 past reports still caught.

Shadow run 21 days · diff report signed by tuning lead · awaiting rule governance board

CUST-0088213 · Corporate · Frankfurt · since Sep 2026

Example Trading GmbH · customer risk

Rating

High

Changed

13 Oct, by model 2.0 + L2

Risk factors

Weights follow the bank’s business-wide risk assessment, version BWRA-2026.2.

Reviews and triggers

Next periodic reviewApr 2027 (was Sep 2027)

Event review openDue 27 Oct

TRIGGERED BY

Alert A-1042 escalated to a case
Beneficial owner change on 1 Oct
Possible PEP match on a director

Products held and the risks they carry

Product	Exposed to	Rules watching	Used as expected?
Current account	Pass-through, layering	TM-07, TM-02	No: volume 4× declared
FX payments	Corridor risk, layering	TM-11	Partly
Documentary credit	Trade-based laundering	TM-19, TF-03	Not yet used
Corporate cards	Rapid movement via cards	TM-22	Yes

Override the rating

Overrides need a reason and a second approver. Downgrades from High also need the MLRO.

New rating

Reason

FI-0142 · Respondent bank · non-EU · relationship since 2019 · EUR vostro account

Harbour Commercial Bank Ltd

High risk · enhanced due diligenceSenior approval: renewed Mar 2026

Due diligence

Due diligence questionnaireReceived Mar 2026

Ownership and managementVerified

AML programme assessmentAdequate, 2 findings

Sanctions controlsAdequate

Shell bank checkNot a shell bank

Adverse media1 article, reviewed

Payable-through accounts are not permitted for this respondent.

Flows vs expected, last 90 days

Volume vs declared+62%

Payments with missing originator data4.8%

Round-amount share11%

We see the respondent’s customers only through payment data, so monitoring focuses on patterns and data quality, not on individuals.

Banks behind the respondent

Found in payment routing fields, last 90 days

Downstream bank	Declared?	Payments	Value (EUR)
Coastline Savings Bank	Yes	1,204	18,420,000
Desert Rose Finance	Yes	336	4,105,000
Meridian Private Bank	No	91	2,870,000
Unity Exchange House	No	57	640,000

2 banks not declared in the respondent’s questionnaire are routing payments through this account. An information request has been drafted.

Requests to the respondent

Undeclared downstream banks

Draft · secure channel · 10-day reply

Originator of 3 payments, 2 Oct

Sent 6 Oct · reply overdue by 1 day

Overdue

Annual questionnaire refresh

Due Mar 2027

Scheduled

Register · 214 active entries

Name	List	Reason	Owner	Expires

Nordwind Handels UG

Added27 Oct 2025, CASE-2025-0981

Legal basisBank’s legitimate interest · DPIA-14

EffectOnboarding blocked; alert on payments

Reviews1 of 1 done

Visible to FCC and onboarding. Customer-facing teams see only “refer to compliance”, never the reason.

Review before expiry

Why the entry is still needed (required)

CP-55120 · Not our customer · United Arab Emirates · first seen 22 Sep 2026

Orion Commodities Ltd · counterparty

Our customers paid or paying

7

Value, 90 days

€3.21m

Open alerts across customers

4

Screening

No hit

Our customers dealing with this counterparty

Customer	Direction	Value (EUR)	Customer since	Status
Example Trading GmbH	In	917,000	Sep 2026	Case open
Nordlicht Logistik AG	In	640,500	Aug 2026	Alert open
Hafen Import KG	In and out	588,000	Oct 2026	Alert open
Lago Blu SRL	In	412,300	Sep 2026	Alert open
Kessler Metall GmbH	Out	301,000	2014	No alerts
Ferro Atlantique SAS	In	226,900	Aug 2026	No alerts
Weber Maschinenbau	Out	124,000	2009	No alerts

Pattern across customers: 5 of 7 opened their account after August 2026 and send funds on within 48 hours.

Open-source material

Company registry extract

Public company register · captured 14 Oct 2026 10:12

sha256 7e10…d9b3

Trade press article on director

News website · captured 14 Oct 2026 10:20

sha256 b2c9…41aa

Company website, about page

Company website · captured 14 Oct 2026 10:24

sha256 0f6d…e27c

Open sources only. Pages are archived and fingerprinted on capture. No logins, fake profiles or contact with the subject.

Investigator notes

“Director listed on registry is also director of 3 other firms paying our customers.” — L2, FCC DE, 14 Oct

2 further notes sit in restricted cases you cannot open.

Team workload

Investigator	Languages	Skills	Open	Near SLA	Load

Workload view only. Individual performance is not ranked here, in line with the works agreement.

Internal escalations

Request	To	Due	Status
PEP relationship approval · K. Brandt	Senior management	17 Oct	Waiting
Exit decision · Nordlicht Logistik AG	Exit committee	22 Oct	Scheduled
Trade documents for 3 invoices	Relationship manager	18 Oct	Sent
Hold P-88114 ends before review complete	MLRO	Mon 19 Oct	Urgent

Requests to business or front office are checked for tipping-off before sending; they never reveal a report.

Router suggestions · 9 unassigned

Rules: language, country, product skill, seniority for high risk, no own-branch customers.

Shared cases

CASE-2026-0417 · Example Trading

Lead: A. Weiss · with fraud team and FCC IT

CASE-2026-0409 · Orion network

Lead: L. Moretti · 4 linked customer cases

One lead decides; contributors add evidence and notes.

Regulatory change register

Germany · Italy · France · EU · sanctions regimes

Change	Where	Applies	Affects	Status

What this change touches

Found through the legal-reference registry: each rule records which provision it implements.

Draft summary

Not validated

Machine-drafted from the official text. It may be wrong and is not advice until Legal validates it.

Owner: Compliance advisory · Validator: Legal · due 30 Oct

Open hits

18

4 from today’s EU list update

Payments held by screening

5

Oldest held 41 min

Lists live

5 of 5

All within the 60-min latency target

Safety-net disagreements

0

Independent exact matcher · 24 h

Hit review Payment holds (5)Ownership and control List updates

Hits to review

Sorted by score

Field	Our record	List entry	Match

Why it matched

Explanation values, not probabilities. Name matcher 3.2 · hit threshold 0.80.

History of this pair

Your decision

True match · send to sanctions officer False hit · remember for this pair Need more information Rationale (required)

A cleared hit stays cleared for this pair until our record or the list entry changes.

Checks

✓Safety-net matcher: no exact or normalised hit

✓List version live

✓True matches need a second reviewer

Payments held by screening

Nothing is released unscreened

Payment	Rail	Amount	Matched against	Held	Status

What happens without a decision

SEPA InstantRejected inside the 10 s budget

SEPA credit transferHeld for review

SWIFT MT / MXHeld for review

CardsDeclined

Fail-closed per rail. Release needs a named reviewer and a reason.

Today

Payments screened1,262,118

Held for review23

Released after review17

Instant payments rejected3

Adria Shipping d.o.o. · ownership chain

Snapshotted 14 Oct 2026 10:12 with the decision

Two holding companies, each majority-owned by the same designated person, together own 75% of the customer. Neither holding company is listed itself.

Result per regime

Regime	Aggregated	Result
OFAC · 50% rule	75% by blocked persons	Blocked
EU	75% indirect	Owned or controlled
UK	75% indirect	Owned or controlled
UN	Not designated	No effect

Aggregation logic is configured and versioned per regime [confirm against each regime’s current guidance].

Effect

!All outgoing payments held · 14 Oct 10:31

✓Sanctions officer notified for freeze decision

✓Report to the competent authority drafted

List versions

List	Version	Published	Live	Latency	Changes	New hits
EU consolidated	EU-2026-10-14	14 Oct 09:34	10:12	38 min	+12 · −3 · 7 amended	4
OFAC SDN	OFAC-2026-10-13	13 Oct 21:05	21:31	26 min	+8	1
UK sanctions list	UK-2026-10-11	11 Oct 10:00	10:24	24 min	+3 · −1	0
UN Security Council	UN-2026-10-02	02 Oct 16:40	17:19	39 min	+1	0
PEP data (licensed)	PEP-2026-10-12	12 Oct 02:00	02:46	46 min	1,204 records changed	9

Each version is immutable, with signature and checksum verified on arrival. Delistings are versions too.

Delta re-screening · EU-2026-10-14

Parties re-screened2,410,388

Run time11 min

New hits4

Hits closed by delisting2

False-hit memory reset (entry amended)3

Latency, last 30 versions

Minutes from publication to live screening · dashed line is the 60-min target.

Verification of Payee checks today

182,406

2.1% no match

Payments stopped after a warning

1,148

Customer chose to stop

Fraud prevented, month to date

€1.21m

Confirmed after call-back

Mule accounts flagged this week

14

5 linked to AML cases

Verification of Payee

Result	Share	Paid anyway	Fraud rate when paid
Match	94.1%	—	0.001%
Close match	3.2%	71%	0.02%
No match	2.1%	39%	0.41%
Check not possible	0.6%	88%	0.05%

Required for euro credit transfers under the Instant Payments Regulation. A no-match result raises the fraud score; it never blocks a payment on its own.

Scam warnings in the app

Scam type	Warnings	Stopped	Fraud after warning
Impersonation (bank, police)	3,212	48%	0.6%
Invoice redirection	644	51%	0.3%
Purchase scam	2,480	9%	1.2%
Investment scam	1,906	22%	2.9%
Romance scam	288	12%	6.1%

Romance and investment warnings rarely stop the payment, so these patterns route to a call-back instead of an in-app warning.

Recalls

Recall	Amount	To	Sent	Status
RC-0418	18,400	EU bank	Today 10:02	Awaiting reply
RC-0411	9,750	DE bank	14 Oct	Funds returned
RC-0406	42,000	LT e-money institution	12 Oct	€11,300 returned
RC-0399	3,900	DE bank	09 Oct	Funds gone

Mule network · payee DE89 …4471

High

5 of our customers paid this account in 6 days. 92% of the money left within 3 hours, mostly to a crypto exchange.

Champion and challenger

Measure	F-3.1 champion	F-3.2 challenger
Fraud caught (by value)	87%	91%
Hold rate	0.90%	0.84%
Released after call	74%	79%
p99 latency	38 ms	44 ms
Days in shadow	—	21

The challenger scores every payment in shadow but decides none.

Fraud labels awaiting QA · 38

Impersonation17

Account takeover9

Invoice redirection6

Money mule6

Confirmed-fraud labels train the next model, so QA checks them first. Tags come from the fixed taxonomy only.

Payment decisions today

4,218,906

Screening, fraud and holds

p99 decision latency

112 ms

Budget 150 ms

Payments on hold

312

Waiting for a named reviewer

Rejected for no decision

3

Instant only · 0.0004%

Live decisions

Streaming from the payment hub

Time	Payment	Rail	Amount (EUR)	Decision	Decided by	Latency

Fail-closed rules per rail

Rail	No decision in time	Budget	Last fault-injection test
SEPA Instant	Reject with reason code	150 ms of the 10 s window	Passed 12 Oct
SEPA credit transfer	Hold	2 s	Passed 12 Oct
SWIFT MT / MX	Hold	2 s	Passed 12 Oct
Cards	Decline	100 ms	Passed 09 Oct
Internal transfers	Hold	2 s	Passed 09 Oct

Account actions · four-eyes

Freeze outgoing payments · Example Trading GmbH

Requested by A. Weiss (L2) 09:55 · CASE-2026-0417 · waiting for a second approver

Block card ending 4471

Fraud · approved 09:12 · applied in core banking 09:12:04

Applied

Lift restriction · Café Rosen UG

Downgrade of a restriction needs the MLRO

With MLRO

Models may hold a payment. Only named people release it, or restrict an account beyond a hold.

Connected systems

Core banking DE · API v39 ms

Payment hub · SEPA and SWIFT14 ms

Card processor6 ms

Core banking IT · file intakeLast file 06:00

Core banking FR · retryingHeld, not released

Every action sent to core banking carries the decision ID, so the bank’s ledger and Providence’s record can be reconciled.

Cross-case linking · FCC DE · refreshed 06:00

Link suggestions

4 openSuggestions only · a named investigator decides

Cluster around CASE-2026-0417

Solid lines are confirmed links. Dashed orange lines are suggestions that nobody has decided yet.

How suggestions are made

Shared identifiersIBAN, device, phone, email, address, director

Shared behaviourSame counterparties, payment chains within 48 h

Entity resolutionSplink 0.9 · match weights stored

Down-weightedBusiness-centre addresses, registered agents

Dismissals need a reason, and the reasons are used to retrain the suggester.

CASE-2026-0417 · Example Trading GmbH · 5 documents from RFI replies and registries

Document intelligence

Documents

Virus-scanned · fingerprinted

Extracted facts

model docs 1.4

Every fact links to its page and region. Translations help reading; the original stays the evidence.

Requests for information · 1st line · Germany

Customer requests

4 open1 overdue

Requests

Request	Customer	Asking for	Sent	Due	Status
RFI-0915	Lago Blu SRL	Source of funds	—	—	Draft
RFI-0912	Example Trading GmbH	Invoices, contracts, shipping documents	13 Oct	27 Oct	Awaiting reply
RFI-0907	Nordlicht Logistik AG	Source of funds, top 5 customers	01 Oct	15 Oct	Overdue 2 days
RFI-0901	Hafen Import KG	Ownership chart	29 Sep	13 Oct	Received · 3 files

Reminders go out on day 7 and day 12. Overdue requests go to the team lead. Received files are scanned, fingerprinted and added to the case’s evidence locker.

Compose · RFI-0915 · Lago Blu SRL

Message

Channel

Documents requested

What the customer sees

online banking · secure messages

From: Your bank · Client service

Request for documents

Contracts and invoicesUpload

Exit decision

Draft · exit committee 22 OctCustomer since Aug 2026 · rating High

Grounds

Alert A-1039 · round-amount transfersEscalated 09 Oct

Linked to the Orion network (CASE-2026-0409)Confirmed link

RFI-0907 · source of fundsOverdue 2 days

Risk ratingHigh since 02 Oct

Reporting statusVisible to the MLRO only

Contributing rules and models are stored with their versions: TM-02 v3.0, model 1.7, risk model 2.0.

Alternatives weighed

Keep and monitor · enhanced monitoring, review in 90 days Restrict · no FX payments, no instant payments to non-EU Exit the relationship · two-month notice Why the milder options are not enough (required)

Contestation dossier

✓Contributing rules and models, with versions

✓Each rule traced to its typology and legal reference

✓Alternatives weighed, with reasons

!Customer’s reply considered · not received yet

✓Named decision-maker and four-eyes sign-off on decision

One decision, three audiences

Audience	Sees
Supervisor	Full dossier, logic and versions
FIU	Grounds for suspicion, if a report exists
Customer, court	Notice with general reasons; no reference to reports or internal reviews

Disclosure is layered so the dossier stays reviewable without tipping off the customer.

After the decision

Notice period2 months [confirm per product]

Internal listExited · financial crime · 12 months

MonitoringContinues until the account is closed

Production orders and information requests · Germany

Authority requests

9 openMedian cycle time 6.4 working days

Scoped retrieval preview

Records	As at	Items	In scope
Account statements, 01 Jan – 30 Sep 2026	30 Sep	214 pages	Yes
KYC file and beneficial owners	30 Sep	1	Yes
Payment messages	—	61	Yes
Internal case notes and reports	—	—	Not requested

Retrieval is a point-in-time query bound to the order’s scope. It is logged, and nothing is copied into ordinary cases.

Legal gate

○Legal basis stated in the order

○Scope matches the order

○Confidentiality flag set: do not inform the customer

No step can skip the Legal gate. A request can prompt a customer review, never a report on its own.

Management information · metric set MI-2026.3 · as at 16 Oct 2026 06:00

Financial crime overview

Open cases by age

< 10 days10–30> 30

8 weeks agoThis week

Decided within SLA

Target 95%

8 weeks agoThis week

From alert to report, by rule

Conversion is a diagnostic, never a target

Rule	Alerts	Cases	Reports	FIU rated useful

Speed, paired with quality

Median L1 decision · 14 minQA pass 97%

Cases closed · 388QA overturned 3.1%

Reports filed · 61FIU rated useful 84%

Holds decided in time · 100%Released after call 74%

Coming up

Hold ends · P-88114Mon 19 Oct

Exit committee · 3 proposals22 Oct

Authority requests due this week2

AMLR applies in full10 Jul 2027

Team-level figures only. No individual analyst rankings, in line with the works agreement. Every figure is a versioned query on the event log and can be reproduced as at any date.

TM-07 · Rapid in-and-out · draft v4.3 · based on v4.2 in force

Rule sandbox

12 months of history · pseudonymisedRuns in the EU cloud, never on live data

Rule definition

One definition runs in streaming and batch

Parameters

Score threshold70

Lookback (days)30

Segment

Back-test, last 12 months

Alerts per month214in force: 214

Past reports still caught14 of 14reports filed on this typology

Typology test pack23 of 23scenarios that must alert

Days from pattern to alert21median, in force: 21

Alerts per month

In forceDraft

Oct 2025Sep 2026

Path to production

✓Back-test on 12 months

○Shadow run beside v4.2 · 21 days

○Diff report signed by the tuning lead

○Rule governance board approval

Model inventory · 8 models

Click a row for its model card

Model	Purpose	Version	Validated	Next	Drift (PSI)	Status

PSI above 0.10 triggers a review; above 0.25 the model owner must act within 10 working days.

Conditions from validation

Sampled this week · 46 cases

Week 42

Random 5%Blind-first agreements 20%Copilot overrides 100%High-risk closures 100%

Case	Decision	Why sampled	Reviewer	Status

Agreeing with the copilot vs overriding it · team level

Agreed with copilot71%

Overrode copilot29%

QA overturn · agreed4.2%

QA overturn · overrode2.0%

Agreements are overturned twice as often as overrides, so agreements are now sampled at 20%. Aggregate only; no individual analyst figures.

Checklist · A-0997

Score

Training mode

Training

New analysts work synthetic cases built from the canary typologies. Training cases never enter production queues, MI or model training.

Pass-through6 / 6

Structuring4 / 6

Trade-based2 / 6

Team availability · next two weeks

AvailableAwayPart daySLA due while away

Cases at risk from absences

Router proposals · team lead approves

Case	Owner	Away	SLA due	Proposal

Proposals follow the routing rules: language, country, skill, seniority for high risk, no own-branch customers, and current load.

SLA forecast · next 10 working days

Breaches if nothing changes4

After approved proposals4

MLRO deputy

MLRO away23 – 27 Oct

DeputyDr. R. Vogel

Takes over automaticallyFiling decisions, hold timers, urgent escalations

Handed over2 reports awaiting decision · 1 hold ending 26 Oct

✓Deputy appointment on file and notified

Notification rules

Event	Who	Channel	Timing

Content policy for external channels

✓Messages carry the case ID, the action needed and the due time only

✓Never: customer names, amounts, reasons, or whether a report exists

✓Links open Providence, which checks access again

✓Chat buttons can acknowledge; they can never close, escalate or file

✓1st-line staff never receive filing or hold events

✓Every message is logged with delivery and open time

Preview

Delivery log · today

Time	Event	To	Channel	Opened
09:58	SLA within 24 h	L2 owner	Teams	10:03
09:41	Hold ends next working day	MLRO	Teams + email	09:44
09:12	QA returned a case	L2 owner	Teams	not yet
08:00	Daily summary	Team leads (3)	Email	3 of 3
06:14	Late feed · Payment hub IT	On call	Pager	06:15 ack

Feeds reconciled

23 of 24

1 late · Payment hub IT

Screening p99

112 ms

Budget 150 ms

Streaming monitoring lag

41 s

Target ≤ 60 s

Canaries today

64 of 64

One per live rule · all alerted

Feed completeness · business date 15 Oct

Reconciled every 15 min

Feed	At source	Monitored	Value	Status	Owner
Core banking DE · postings	3,912,044	3,912,044	Match	Reconciled	Data owner DE
Payment hub · SEPA	1,204,331	1,204,331	Match	Reconciled	Payments
Payment hub · SWIFT MT / MX	48,212	48,212	Match	Reconciled	Payments
Cards · DE	2,881,907	2,881,907	Match	Reconciled	Cards
Payment hub · IT	412,880	398,114	−3.6%	Late 42 min	Data owner IT
KYC and beneficial-owner changes	18,204	18,204	Match	Reconciled	KYC ops

Correctness objectives

Objective	Target	Now
Completeness breaks open over 1 h	0	0
Missed canaries	0	0
Orphan alerts (hub → case → closure)	0 daily	0
Safety-net disagreements open over 24 h	0	0
Payment screening availability	99.99%	99.996% · 72% of budget left
Unexplained snapshot recomputation drift	0	1 · day 2 of 5

Active incidents

INC-2210 · Payment hub IT feed lateSev 2

Alerts after 09:10 may be incomplete. Data age is shown on every affected panel. Owner: Data owner IT.

INC-2207 · Recompute drift on 1 decisionSev 3

Nightly recomputation differs from the stored snapshot for one alert score. Investigating FX version pinning.

Services

Payment screeningOperational

Safety-net matcherOperational

Streaming monitoringOperational

Batch monitoring06:00 run done 05:12

Case managementOperational

Decision recordHash chain intact

Ingestion · ItalyDegraded

EU cloud batchOperational

If something fails

Screening down: instant payments are rejected, others held. Cloud down: daily monitoring runs on-prem, done by 12:00. A late feed is shown with its data age, never hidden.

Engagement AUD-2026-DE-04 · annual AML audit (PrüfbV) · external audit firm

Audit export

Export not requested

Build a sample

Population

Method

Seed

Sample size60

#	Case	Risk	Outcome	Closed

Population, method and seed are stored with the export, so the auditor can redraw the same sample independently.

Package contents

Case files and timelines Event logs with hash chain Decision snapshots Rule, model, list, FX and calendar versions in force Evidence fingerprints (documents on request) Mapping to PrüfbV report sections Personal data in clear (needs MLRO approval)

Personal data is pseudonymised by default.

Independent verification

Auditors check integrity with an open-source tool that runs offline, instead of trusting Providence’s own “verified” label.

providence-verify AUD-2026-DE-04.zip \
  --key bank-signing-2026Q3.pub

✓Hash chains intact

✓Snapshot fingerprints match

✓Signatures valid · key 2026-Q3

✓Every referenced version resolves

Services healthy

41 of 43

Ingestion IT, Kafka lag

Error budget · payment screening

72%

No change freeze

Highest consumer lag

14,766

payments.it.raw · ingest-it

On call

M. Novak

Secondary T. Lindqvist · paged 06:14

Service map

Click a service · amber means degraded

Kafka topics

Topic	Partitions	Consumer group	Lag	Msg/s	Dead-letter

Flink jobs

Job	State	Last checkpoint	Duration	State size	Restarts 24 h
tm-streaming-de	Running	12 s ago	3.1 s	412 GB	0
tm-streaming-it	Running · back-pressured	14 s ago	2.4 s	96 GB	0
screening-delta	Running	8 s ago	0.9 s	21 GB	0
canary-checker	Running	9 s ago	0.4 s	2 GB	0
profiles-daily	Finished 05:12	—	—	1.8 TB	—

Trace · SEPA Instant P-914233

112 ms end to end · budget 150 ms

Spans that run in parallel are drawn lighter. Payload fields are masked in traces.

Runbook RB-ING-07

INC-2210

Late feed or schema violation on an ingestion adapter.

✓Confirm lag and dead-letter countauto

✓Find the recent change · CHG-8781auto

3Roll back ingest-it 2.7.0 → 2.6.4

4Replay dead-letter queue (37)

5Confirm reconciliation closeswaiting

Rollbacks need a second engineer. Changes to screening or filing also need the change advisory board.

Recent changes

When	Change	Status
10:02	case-service 4.18.2 CHG-8812 · canary at 10%	Checks passing
Yest. 17:20	copilot prompt p-42 CHG-8790 · shadow only	In validation
Yest. 14:05	ingest-it adapter 2.7.0 CHG-8781 · stricter schema checks	Suspected cause
Mon 09:30	screening-engine 3.2.1 CHG-8744 · CAB approved	Stable

Access

Engineers see system data only. Payloads are masked, and customer names, case content and reports never appear here.

Read-only analytics · every query logged with its purpose

Ask the data

Data as at 16 Oct 2026 06:00

Purpose (required) Question

Try

Ask a question in plain language

The AI turns it into a query and shows it to you. The database computes the answer, so every number comes from the data, never from the model.

Query

Generated · read-only · scoped to the purpose

Guardrails

✓Read-only: queries can never change data or cases

✓Scope follows the purpose and your need-to-know

✓The query is shown before any result

✓Numbers come from the database, not the model

✓Ambiguous names are resolved for you to confirm

✓Reports and their existence are never queryable outside the MLRO role

Your recent queries

None yet in this session.

Platform Mockups

My queue