Skip to main content
FinCrimes

An investigation workbench built around the evidence

Investigators in FinCrimes work each alert or case with the facts, the transactions, the money flow and the network side by side. An AI copilot assembles what the platform already knows and drafts narratives that cite their sources, while every decision that closes a case, files a report or releases a hold needs a second person. Playbooks handle the routine steps and stop the moment a workspace’s kill switch is pulled.

See how it works
InvestigationworkbenchEvidence and chain ofcustodyAutomation playbooksCase managementAI copilotReports for regulatorsand committeesInvestigationsPART OF DARK POOLS FINCRIMES
Capabilities

What investigations gives your team

Investigation workbench

A focused workspace per alert: facts and cases on the left, transactions or cash flow in the center, the network on the right, and a time-range strip that filters the activity.

  • A scored evidence grid and money-flow view for every alert
  • A plain-language explanation of each criterion, with its threshold and observed value
  • A seven-stage trace: ingested, detected, routed, actioned, escalated, delivered and disposed
  • Full-page customer and claimant 360 views, each with its own network

Case management

Alerts escalate into cases that inherit severity, subjects and exposure, computed from the linked transactions and claims. Cases follow a configurable lifecycle from open through triage, investigation and review to closure.

  • Merge duplicate cases and split unrelated ones
  • An escalation ladder with authority and an SLA at each tier, and a separate permission to reopen a closed decision
  • Saved worklists, column views and shareable filters
  • Similar past cases ranked by shared entities, typologies and identity rings

Evidence and chain of custody

Attachments, workflow changes, escalations and dispositions are written to a hash-chained custody ledger. The case view shows the chain, whether it verifies, and the exact entry where any break occurs.

  • An examination pack with criteria, lineage, actors and ruleset version
  • Every action attributed to a person or a named automation
  • Outcomes and recovered or lost amounts recorded on each case
  • In insurance, scanned claim documents read into structured fields and compared across claims for shared authorship, reused images and conflicting data

AI copilot

The copilot works from facts the platform has already computed. It drafts case, cluster and SAR narratives from the alert explanations and linked evidence, lists the basis for each statement, and falls back to a deterministic draft if the AI engine is unavailable.

  • Related alerts correlated into one cluster with one narrative
  • Confident false positives closed as reversible machine dispositions, with everything else kept for a person behind a one-click confirm packet
  • An agentic investigator that runs the trace, network, screening and precedent tools, cites every retrieval and declines below a confidence floor
  • Proposals reach the alert only after a person confirms them

Automation playbooks

Playbooks turn standing decisions into rules made of a trigger, conditions and an ordered list of actions. Decision tables add branching logic and aggregate conditions, such as a third alert on the same person within a day or cumulative exposure above a limit.

  • Escalate to a case, assign, set status, dismiss low-score noise, notify or dispatch an interdiction recommendation
  • Dry runs and impact simulation before a playbook goes live
  • HMAC-signed webhooks and email delivery, retried with backoff
  • A per-workspace kill switch, and automation never moves money

Reports for regulators and committees

Any case, batch or workspace produces a branded investigation report in DOCX or PDF with the narrative, the evidence and embedded charts. Cases flow directly into STR and SAR drafts in regulator formats.

  • Detection snapshot, severity and typology breakdowns, key subjects and exposure
  • goAML-format and FinCEN SAR filings, each with a second approver
How it works

From data to decision

  1. 01Open the alertThe workbench loads the focal entity, the facts, the money flow and the network around it.
  2. 02AssembleThe copilot gathers the trace, screening results, related alerts and similar past cases, citing each one.
  3. 03InvestigateThe analyst expands the network, traces funds and adds evidence to the custody ledger.
  4. 04EscalateCases move up the escalation ladder, with playbooks handling assignment and notifications.
  5. 05DecideOne person proposes the disposition and a second approves it. The outcome becomes a training label.
  6. 06ReportThe narrative and evidence go into the investigation report and, where required, the STR or SAR.
In the field

Where it is used

InsuranceGhost policies and provider collusionBilling clerks and colluding medical providers write phantom policies and file claims for treatments no patient ever received, quietly bleeding the book for years.Phantom claims surfaced across the bookBankingMule network cashing outStolen funds hop through dozens of freshly opened accounts and exit through ATMs and remittance corridors before the bank's overnight batch review even runs.Ring frozen before the cash-out
FAQ

Questions buyers ask

Get started

Take the next step

See investigations working on your own data, deployed on infrastructure you control.

Explore FinCrimes