Independent research prototype

One record from alert to filing.

Providence brings transaction monitoring, screening, fraud and case management onto one auditable record, so every decision a bank makes can be explained, defended and replayed.

Independent research prototype · built in my own time · synthetic data only
MonitoringTM-07 · 06:04 ScreeningPEP hit · 0.81 Fraudmule link One caseCASE-0417 Report filedevery claim cited
DecisionFile report
Decided byMLRO, named
EvidenceE-03 E-05 E-07
Hash chain✓ intact
DESIGNED AROUNDAMLRAMLADORAEU AI ACTGDPRGwGgoAMLSEPA INSTANT
The problem

Four tools. One customer.
No shared memory.

Each engine judges alone, evidence lives in inboxes, and the audit trail is rebuilt after the fact. Scroll to see what changes.

Transaction monitoringStatic thresholds, scenario sprawl
alert-by-alert
Name screeningSame false hit, reviewed again
no memory
SanctionsOwnership logic in spreadsheets
manual
Case managementEvidence scattered across tools
hard to replay
Providence

One entity. One case. One record.

Alerts from every engine roll up to the customer. Every view, decision and version is stored once and can be replayed.

entity-centricexplainablehumans decidereplayable
Product tour

Built for the people who have to defend the decision.

1st line · triage

Judgement first, suggestion second.

On sampled cases the analyst records a view in their own words before the score and copilot appear. You can measure whether suspicion was formed by a person or only signed off.

  • Queue ordered by risk and deadline
  • Calibration in force shown on every alert
  • Equal-weight close and escalate
2nd line · investigation

Room to reason, with the reasoning kept.

Ownership and payment networks, a hypothesis board and an evidence locker with fingerprints. Facts that cut the other way are required before QA.

  • Unconfirmed links drawn as unconfirmed
  • Point of suspicion sealed, never back-dated
  • Linked fraud and AML cases
MLRO · filing

Nothing is signed that is not backed.

The copilot drafts, citing evidence for every sentence. Uncited claims block sign-off until someone cites or removes them. Hold, tipping-off lock and monitoring start on filing.

  • goAML built and schema-validated
  • Four-eyes before submission
  • Working-day hold timers per federal state
Audit · replay

Open the record instead of asking for it.

See exactly what was known on any date, which rule, list and model versions were in force, and who decided. External auditors verify integrity with an independent tool.

  • Hash-chained event log
  • Decision snapshots, object-locked
  • One-click supervisor pack
PROVIDENCE TriageInvestigationFilingAudit
My queue · 12
Rapid in-and-out HighExample Trading · 2 days
Possible PEP HighK. Brandt · today
Round amounts MedNordlicht · 3 days
Risky corridor MedHafen Import · 4 days
A-1042 · TM-07 v4.2
Example Trading GmbH
Wholesale · Frankfurt · since Sep 2026
🔒 Risk score hidden until you save your view
82High · 12 above threshold
Inflows 4.1× peers +31
Inflows 4.1× peer median · 82% out within 48 h · 6 new counterparties
Your assessment
Likely explained by business
Needs investigation
Funds pass through within two days…
Save view and reveal
PROVIDENCE TriageInvestigationFilingAudit
Ownership and payment network
Example Trading Orion · AE Sunrise · AE Meridian · CY Baltic · EE Brandt Holding K. Brandt · PEP?
Point of suspicion
E-03 · E-05 · E-07 relied on
🔒 Sealed 14 Oct 09:50
Hypotheses
Pass-through · open
Trade-based layering · open
Seasonal cycle · ruled out
PROVIDENCE TriageInvestigationFilingAudit
Grounds for suspicion
Between 22 September and 6 October the account received €1.38m from two UAE companies E-03. At least 96% was sent on within 48 hours E-07. Invoices carry no shipping documents E-05. The pattern is typical of pass-through firms E-07.
Your decision
File report with the FIU
Do not file; record reasons
✓ QA approved
✓ goAML schema valid
! 1 sentence uncited
Sign · fix 1 item first
PROVIDENCE TriageInvestigationFilingAudit
Suspicion timeline
22 SepPattern
13 OctAlert
13 OctEscalated
14 OctSuspicion
15 OctFiled
Event log ✓ Hash chain intact · 41 events
06:04EngineAlert A-1042 · TM-07 v4.2
09:15L1Initial view recorded · blind-first
09:50L2Suspicion sealed on E-03, E-05, E-07
10:30CopilotNarrative drafted · 9 citations
09:42MLROFiled · FIU receipt stored
One platform, every role

Everyone opens the screen they need first.

Analysts, the MLRO, the board and the engineers who keep it running each get a home built around their day, all on the same record.

1st and 2nd line

Start the day knowing what matters.

My day brings tasks, deadlines and changes on your cases into one list. Customer 360 shows everything the bank knows about a customer, in order.

  • My day: tasks, SLAs and mentions
  • Customer 360 timeline across every product
  • Transaction explorer with red-flag tagging
  • Similar past cases and typology guides
  • Handover notes drafted from the case

My day · Friday5 open

✓
Decide on alert A-1061
Fused into CASE-2026-0417
12:00
✓
Answer QA findings
CASE-0398 · 2 findings
16:00
✓
Review RFI reply
3 files, fingerprinted
Today
09 Oct
Frischemarkt Kaiserlei · card
€2,500 · Offenbach
RF-07 gift cards
⌘K jumps to any of 64 screens
MLRO office

Everything only you can decide, in one queue.

The MLRO inbox orders reports, holds, overrides, exits and access requests by legal deadline, across every workspace, and your deputy takes over automatically when you are away.

  • MLRO inbox ordered by legal deadline
  • Report register with FIU receipts and holds
  • Findings tracked to validated closure
  • Risk assessment heat map linked to rules
  • Annual report with every figure sourced
  • Monthly attestation in the hash chain

MLRO inbox9 waiting

Decide: file or not
CASE-2026-0417 · 24 h target
20:00
Hold ends · €460,000
3 working days · Hesse calendar
16:00
Access to an employee case
Restricted tier
Today
Downgrade from High
Second approver given
2 days
Exit decision
Contestation dossier attached
22 Oct
Management board

Where we stand, on one page.

Risk indicators against appetite, regulatory exposure, customer impact and the cost of compliance. Aggregated, with no customer or case details.

  • Executive summary against risk appetite
  • Cost and capacity with hiring scenarios
  • Customer impact and de-risking
  • Regulatory exposure and exam calendar
  • Rollout steering with go-live gates
  • Board pack with a sign-off chain

Key risk indicators│ appetite

Reports within 24 h96%
Staff trained96%
Lists live in 60 min100%
Capacity vs demand94%
AMLR readiness68%
GermanyItalyFrance3 decisions for the board
Site reliability

Built to stay up, and to prove it.

Error budgets, incident command and disaster recovery for a platform that screens payments around the clock. Engineers see system data, never case content.

  • Error budgets with burn-rate alerts
  • Incident workspace with the DORA reporting clock
  • Failover that needs two approvals
  • Capacity forecasts for month-end peaks
  • Change freezes, canaries and feature flags
  • Log search with customer data masked

Reliability24/7

72%SCREENING BUDGET LEFT
Major incident · notify regulator in
3:59:59
Clock starts on classification
Payment screeningDecision recordStreaming monitoringIngestion · ItalyFailover site · hotCanaries 64 / 64
Platform

One data spine. Every engine. One case.

Fewest platforms that do the job: one stream and batch engine, one relational store, one search engine. Every rule, list, model, FX rate and calendar is versioned, and every decision is stored as a snapshot.

SOURCESDATA SPINEENGINESCASEOUTPUTS
◆ Decision record and audit log◆ Canary transactions every day◆ Attribute-based access◆ Fail closed per payment rail
Correct all the time

Five guarantees, each one measured.

A property without a measurement does not count. Each guarantee has an engineering control and a daily proof.

Every transaction monitored

Control totals per feed reconciled every 15 minutes. A break is a Severity 1 incident.

Nothing lost, nothing twice

Exactly-once processing with idempotency keys, proven by daily gap scans and chaos tests.

Screening fails closed

No clean decision in time: instant payments are rejected, others held. Nothing is released unscreened.

Detection proven daily

Tagged canary transactions for every typology must alert. A missed canary is Severity 1.

Every decision replayable

Inputs, versions and outcome stored as an object-locked snapshot, recomputed nightly.

AI that shows its work

Ask in plain language. Get an answer you can defend.

The AI writes the query and shows it to you. The database computes the answer. Every number comes from your data, never from the model.

  • 01Every question needs a purpose, and every query is logged with it.
  • 02Ambiguous names are resolved for you to confirm.
  • 03Scope follows need-to-know; out-of-scope questions read no data.
  • 04Results go into the case as fingerprinted evidence.
✓Customer → Example Trading GmbH · CUST-0088213
✓Last 90 days → 18 Jul – 16 Oct 2026
✓Grocery stores → merchant categories 5411, 5499
SELECT booking_date, merchant, amount_eur
FROM   transactions AS OF '2026-10-16'
WHERE  party_id = 'CUST-0088213'
  AND  mcc IN ('5411','5499')
Transactions23
Total€41,280
At one store19
What’s inside

64 screens. One record underneath.

Every module reuses the same data spine, case model and decision record. None introduces a second case system.

Detection

Monitoring with a tuning lab, in-house screening with a safety net, real-time fraud and payment controls.

SanctionsPEPFraudPayment holds

Investigation

Networks, counterparties, correspondent banks, document intelligence and cross-case link suggestions.

GraphDocumentsRFIsAsk the data

Decisions

Filing to every FIU, exit decisions with a contestation dossier, and a governed authority-request pipeline.

goAMLExitsProduction orders

Oversight

Rule scorecard, rule sandbox, model register, QA and training, internal lists and horizon scanning.

DriftModel riskQA

Team

Rules-based routing, absence-aware SLA forecasts and an automatic MLRO deputy handover.

RoutingAvailabilityEscalations

My work

A daily home for analysts, Customer 360, a transaction explorer with red-flag tagging, and handovers that write themselves.

My dayCustomer 360Red flags⌘K

MLRO office

One inbox ordered by legal deadline, a report register, findings tracker, risk assessment and a sourced annual report.

InboxFindingsRisk assessmentAttestation

Management

Risk appetite on one page, cost and capacity scenarios, customer impact, regulatory exposure and the board pack.

BoardCapacityExposure

Reliability and audit

Error budgets, incident command with the DORA clock, disaster recovery, access reviews and an external audit export.

SREDORAAccessAudit export
Compliance by design

Regulation as configuration, not as a project.

Every rule records the provision it implements, so a change in law becomes a list of tasks.

AMLR and AMLA
Applies from 10 Jul 2027

Ongoing monitoring that can prove what it implements and that it still works.

Legal-reference registryDaily canariesHorizon scanning
Reporting duties
GwG · reporting, hold, tipping-off

Report without delay, hold for the right working days, never tip off.

Sealed point of suspicionCalendar-aware holdsTipping-off lock
GDPR
Art. 22 · data minimisation

No solely automated decision with legal effect; data only where it is needed.

Named decision-makersScoped retrievalExpiring internal lists
EU AI Act
High-risk-level controls

Models rank and draft; people decide. Every prompt and output is logged.

Model registerBlind-first samplingCited drafts
DORA
ICT risk and resilience

Tested failure modes, third-party register and exit plans.

Fail closed per railOn-prem degraded modeRunbooks
References are indicative and should be confirmed against current legal texts.
Security and hosting

Bank data stays home. Only tokens travel.

Real-time screening, cases and reports run in the bank’s own data centres. Elastic batch work runs in an EU cloud on pseudonymised data, and re-identification keys never leave the bank.

  • ◆Attribute-based access on every API call
  • ◆Field-level encryption with HSM-held keys
  • ◆Engineers see system data, never case content
  • ◆Open-source verifier for auditors

On-premise

Payment screening and safety net
Case management and reports
Decision record and evidence
Personal-data vault
Copilot inference
⚿
tokens
only

EU cloud

Batch scenario runs
Back-testing and tuning
Model training
Large backfills
Synthetic test environments
Design targets, not production results

Engineered for bank scale.

150 msp99 payment screening inside the SEPA Instant budget
5,000transactions per second burst capacity
≤ 60 sfrom event to streaming alert
0missed canaries allowed, ever
100%of decisions stored as replayable snapshots
Build roadmap

Built in vertical slices.

The prototype grows one slice at a time. Each slice works end to end on synthetic data, and has to pass the same checks (no completeness breaks, no missed canaries) before the next one starts.

Phase 1
Foundations

Data contracts, synthetic data generator, decision record.

Phase 2
Case management

Triage, investigation and filing on one case record.

Phase 3
Screening

Name and sanctions screening with explainable scores.

Phase 4
Monitoring and fraud

Rules, canaries and real-time holds on synthetic payments.

Phase 5
More jurisdictions

Country configuration and reporting adapters.

A sequence of work for a personal research build, not a delivery plan.

About this project

An independent research prototype.

Providence is a prototype I am building in my own time, to explore how AI-driven detection can stay explainable, contestable and accountable to the people who carry the reporting duty.

  • 01
    The problem. Alerts are judged by separate engines, evidence sits in inboxes, and the audit trail is rebuilt after the fact.
  • 02
    Design principles. Humans decide, every claim is cited, and every decision can be replayed as it was made.
  • 03
    Synthetic data only. No real customer, bank or transaction data is used anywhere in the project.
Proposed doctoral research

Linked to a doctoral proposal.

Providence informs my proposed doctoral research on AI-driven detection and the EU AML reporting obligation.

It is not a commercial product. There is no pricing, no customers and no partner institutions.

Explore the clickable prototype ↗