Marbell
Open cloud portal
Menu
A thick slab of cast glass stands upright in a dark room. Behind it an open case file is a soft blur, and a fine coral line in the floor runs beneath the glass.

Financial crime operations

Your alerts triaged before the shift starts. Your rationale already written.

Overnight our agents investigate each alert across your core banking, screening and registry data. By morning it is a finished file, each statement tied to its source.

The file

Your investigators open files, not alerts.

Alert 88213 Structuring Drafted 03:41

Draft decision: escalate

  1. Between 3 and 21 September the customer paid in cash 41 times at six branches, each deposit just under 10,000.

    Core banking · 41 deposits · read 02:14

  2. The expected activity profile records a salary and no cash business.

    Risk rating engine · profile v3 · read 02:15

  3. The company receiving the onward transfers has no beneficial owner on file.

    Company registry · read 02:17

  4. Report narrative outlined. Filing due 21 October.

    Filing clock · detected 21 September

Most alerts close with the reasoning written out. The rest reach your reporting officer with the report outlined. Investigators can rerun or correct any file.

What a file holds
  • The customer profile from your CRM and core banking, with twelve months of transactions.
  • The expected activity profile, read from your risk rating engine rather than inferred from last month's alerts.
  • Screening hits with their dispositions, adverse media and registry data on every counterparty.
  • The gaps the agent went looking for: an owner missing on file, a counterparty without a registry entry, a profile older than the product the customer now uses.
  • Periodic KYC reviews run the same way. Stale files are refreshed on schedule, ownership changes are screened against sanctions and PEP lists, and the review file is drafted.
  • A quality lane samples closed files from the case manager and reruns them in the same shift.

Barrier

The agent that writes to your customer cannot read that you suspect them.

Each lane works under grants your reporting officer delegates from their own access, scoped to its typology and limited in time.

The barrier as policy

Gate checks each request against written rules in Cedar before it reaches your systems. The first two rules are the lane's grants and the third is the tipping-off control. The denial reads the same whether a case exists or not, so it tells the agent nothing. Routine contact carries on as it would for any customer, so a sudden silence cannot tip the customer off either. Each audit line names the policy version that decided it, so an examiner can replay last year's access against the rules as they stood that day.

// The structuring lane reads core banking, risk ratings and registries,
// and reads and drafts the cases of its own typology.
permit (principal in Lane::"structuring", action == Action::"read", resource in Sources::"structuring");
permit (principal in Lane::"structuring", action in [Action::"read", Action::"draft"], resource in Cases::"structuring");

// Agents that write to customers never read a case.
forbid (principal in Group::"customer-contact", action, resource is Case);
How Gate decides

Deadlines

No file closes without its clock.

A US suspicious activity report is due 30 calendar days after detection. Each jurisdiction's clock is a typed value on the file and escalates ten days early. Your reporting officer signs a complete file.

Where reports are filed
  • Reports are drafted for FinCEN's BSA E-Filing system in the United States and for goAML in other jurisdictions, each with its own clock and format.
  • Every timestamp is an instant in UTC. A time without a zone is rejected before it reaches a clock.
  • Continuing activity reviews are scheduled from the first filing: a review at 90 days and the next report within 120.
fincrime/deadline.py
due      = detection + days(30)escalate = due - days(10)
A chain of ivory punched cards laced together with dark thread hangs in the dark. A new card in the chain is laced in with coral cord.

Procedures

Your procedures manual runs as code.

Each rule is a function with tests. An investigator's correction becomes a rule the fleet follows from its next alert. Last year's closed alerts are rerun under it, and any it would decide differently reopens.

The manual as code 
# fincrime/rules.py
if screening.pep_match(customer):
    return escalate(alert, reason="pep")      # whatever the score

def can_close(alert):
    return len(alert.agreeing_signals) >= 2  # never on a lone signal

baseline = risk_engine.expected_profile(customer)  # not last month's alerts
  • Judgement calls, such as whether a change of payment corridor matters, are decisions pinned to a tested model version. Where a call falls outside what was tested, the file is drafted with that question marked for the investigator.
  • The fleet pins the monitoring vendor's model version per lane. When the vendor ships an update, the affected lanes are rerun on their past alerts before new alerts reach them.
  • Each Monday at 06:00 a quality brief is regenerated from the results: where corrections cluster, which rules changed and which lanes grew, compared with last week.

Architecture

  1. Operating Code

    Procedures, typology playbooks and filing clocks as tested code.

  2. Gate

    Agents hold no passwords. Each grant is a short-lived certificate scoped to its resource.

  3. Your infrastructure

    Your perimeter or Marbell Cloud in Switzerland. Memory per customer follows your retention schedule.

  4. Fleet

    Lanes by typology and product, with a priority lane for sanctions.

For your engineers
  • Operating Code is your procedures manual rewritten as code. A typology playbook becomes a loop, an escalation rule an if, a customer's history a typed variable and a closing standard a test. It grew out of the recursive self-improvement harness our own persistent agents run on.
  • A correction ships when the full suite passes on past files, at the speed the tests run. Your team can rerun any file and see what changed between versions.
  • Model calls go through Gate with zero data retention. Customer data stays on your network or in our Swiss cloud.
  • Every job carries a key built from the customer and the review period, so a restarted agent never files twice.
  • A failed investigation is retried twice from its checkpoint. A lane that nears its time budget is rebalanced by the supervisor agent before it breaches.

Systems

  • NICE Actimize
  • SAS AML
  • Oracle FCCM
  • Temenos
  • World-Check
  • goAML

Every connection leaves the bank outbound through Gate. No port opens inward.

All systems
  • Transaction monitoring with its risk rating engine and model version
  • Name and payment screening, and the watchlist feeds that drive re-screening
  • Core banking and your CRM
  • The case manager with its quality sampling
  • Company registries and data providers
  • The document store and the shared inbox where customer documents arrive
  • FinCEN BSA E-Filing in the United States and goAML elsewhere

Treasury cash operations are the next lane on the same fleet.

A lane between two slabs of cast glass, seen straight down its length. A coral line in the floor runs to a closed case file under a pool of light at the far end.

The pilot starts with your heaviest typology lane.

We run it beside your investigators for a quarter, paid against handling time, first-pass yield or hours returned.

Describe your alert queue How a pilot runs