Finic
ContactTry the API
AML and sanctions

Triage AML transaction monitoring alerts

Decide whether a transaction monitoring alert is explained by what you know about the customer, which typology it fits, how likely it meets the SAR standard, and whether to close it, ask the customer, escalate or file.

Grayson triages a transaction monitoring alert the way your first-level analysts do. It returns whether the activity fits what you know about the customer, which typology it looks like (structuring, a funnel account, layering, trade-based laundering, fraud proceeds, or explained), how likely it meets the standard for a suspicious activity report (SAR), and whether to close the alert, ask the customer for information, escalate it to an investigator or recommend a SAR. It reads the alert with the KYC profile, months of transactions, earlier alerts and what the customer has said, and costs about $0.55 to $0.69 per 1,000 decisions.

  • Decides: Close, ask the customer, escalate or file on a transaction monitoring alert, with the typology and how likely it meets the SAR standard
  • Call it: When a transaction monitoring rule or model raises an alert on a customer
  • Questions: 1 yes/no, 2 choice, 1 score
  • Cost: $0.00055 to $0.00069 per decision ($0.55 to $0.69 per 1,000) for these examples' 15,787 to 19,774 input tokens
  • Latency: 225 to 268 ms for these examples, the median of 5 calls each through api.finic.ai from US-West

Examples

Three alerts, each sent with the KYC profile and expected activity, screening results, 12 months of monthly totals, every posted transaction for the last three months (about 160 to 220 of them), the counterparties, earlier alerts and how they were closed, and what the customer has said and sent. They are a warehouse supervisor depositing cash in amounts just under $10,000, a general contractor paying its subcontractors within days of each construction draw, and a seafood importer passing a new buyer's wires to a packer in Ecuador for a 2% commission.

Open in Playground

Open in Playground

Open in Playground

A yes/no answer is Grayson's probability that it's true. A choice answer is the top option and Grayson's confidence: 0% when every option is equally likely, 100% when one option has all the probability. A score answer is the expected level, numbering the levels in its criteria from 0, with its confidence measured the same way and, when no level reaches 70%, each level's probability. A multiple-choice answer lists the options at 50% or more.

  • action: close alerts automatically only above a strict close threshold you set on your own closed alerts, and send file_sar and escalate above their thresholds straight to investigators. Everything else goes to an analyst with Grayson's answers attached.
  • suspicious_likelihood: use the sum of "Likely" and "Very likely" to order the queue, so the alerts most likely to end in a SAR are worked first and well inside your filing deadline.
  • typology and fits_profile: route each alert to the analysts who know that pattern, and use the typology for the SAR's activity category and narrative. A close call between explained and a suspicious typology, as in the seafood importer, usually means one missing document.

Call it from your code

Save an example as request.json, such as fraud.json, and send it with your API key in GRAYSON_API_KEY:

curl https://api.finic.ai/v1/decide \
  -H "Authorization: Bearer $GRAYSON_API_KEY" \
  -H "Content-Type: application/json" \
  --data @request.json

The problem

Most transaction monitoring alerts are false positives, because rules can only compare amounts, counts and speeds with fixed thresholds. A contractor paying subcontractors the day a draw lands looks like rapid movement of funds, while a customer who keeps every cash deposit at $9,600 can pass for a small business. Analysts close the difference by reading the profile, the history and the customer's own explanations, which is slow, uneven from one analyst to the next and hard to staff.

What to send

Send the alert as your case-management system assembles it for an analyst. The examples send 12 months of monthly totals and three months of transactions in about 16,000 to 20,000 input tokens.

  • The rules that fired and the transactions behind them, with each rule's threshold and the values that crossed it.
  • The KYC profile: occupation or business, expected activity, income or revenue and its source, owners, risk rating and when it was last reviewed.
  • Months of transactions with counterparties. How cash, wires and transfers compare with earlier months shows whether the activity is new, seasonal or tied to an event.
  • Currency transaction reports and branch notes. Same-day aggregation, deposits spread across branches and a customer asking about "the paperwork" are what separate structuring from a cash business.
  • Earlier alerts and how they were closed, including the analyst's reasoning, so an explanation that changes from one alert to the next shows.
  • The customer's answers and documents, word for word: replies to requests for information, call notes, and what the invoices, contracts and shipping records show.
  • Screening and registry checks: sanctions, PEP and adverse media results with their dispositions, and what business registries say about new counterparties.

Add your own policy

Many institutions don't let first-level analysts recommend a SAR, and treat structuring alerts differently because asking the customer about them can tip them off. Put your triage procedure in the state in your team's words. This one sends every alert that already supports a SAR to the Financial Intelligence Unit instead.

Your triage procedure adds this to the state of the obvious example:

{
  "institution_policy": "Alert triage procedure, section 3 (revised 2026-07): Level 1 alert analysts close, request information or escalate; they never recommend a SAR themselves. When the facts already support a SAR, escalate to the Financial Intelligence Unit with a summary, and the FIU decides on filing within the 30-day deadline. Every alert with structuring indicators (a customer's question or statement about avoiding a currency transaction report, or three or more cash deposits between $8,000 and $10,000 in 30 days) goes to the FIU the same day. Never send a request for information on a structuring alert, so that the customer is not tipped off."
}
QuestionWithoutWith your triage procedure
fits_profileUnder 1% trueUnder 1% true
typologystructuring, confidence 93%structuring, confidence 95%
suspicious_likelihood3.61 of 4, confidence 71%3.77 of 4, confidence 82%
actionfile_sar, confidence 93%escalate, confidence 81%

Applied to the clearly suspicious example: the warehouse supervisor's alert meets the procedure's structuring test, so the action moves from recommending a SAR to escalating to the FIU, while the typology, the profile answer and the likelihood stay the same.

Where to call it

  • When an alert is created, before it reaches the queue, so analysts start from a draft and the queue is ordered by likelihood.
  • Again when new facts arrive, such as the customer's reply to a request for information, a teller referral or new transactions on an alerted account.
  • On alerts your team is about to close, as a second check, sending disagreements to a senior analyst.

Cost and latency

ExampleInput tokensPer decisionPer 1,000 decisionsLatency
Obvious15,787$0.00055$0.55225 ms
Legitimate16,464$0.00058$0.58268 ms
Ambiguous19,774$0.00069$0.69238 ms

You pay only for input tokens, at $0.035 per million, and each request is rounded up to the next millionth of a dollar, so a request with a larger state costs proportionally more; every response reports its size in usage.input_tokens. Latency is the median of 5 calls each through api.finic.ai from US-West, and grows with the number of input tokens. Add your own network time to api.finic.ai.

Evaluate on your own data

Score Grayson on your own past cases before you use it: a CSV with one row per case and a column with the right answer to each question. Every other column is sent as the case.

pipx install https://docs.finic.ai/downloads/grayson_cli-0.4.0-py3-none-any.whl
grayson eval my-cases.csv --questions https://docs.finic.ai/recipes/aml-alert-triage/questions.json --label fits_profile=<column> --label typology=<column> --label suspicious_likelihood=<column> --label action=<column>

Each --label names the column with that question's right answer:

  • fits_profile: true or false
  • typology: structuring, funnel_account, layering, trade_based, fraud_proceeds, other_suspicious, explained
  • suspicious_likelihood: a level, such as "Very likely (over 90%)"
  • action: close, request_information, escalate, file_sar

Or run grayson on its own to set up your questions step by step. You get each question's accuracy and a CSV with Grayson's answer next to yours for every case.

Evaluate on your own data

How it works, what you get, and every option.

FAQ

Can Grayson close alerts without an analyst?

It can, if you choose to. Run it on alerts your team has already closed and filed on, pick a close threshold that keeps missed SARs at a level your BSA officer accepts, and keep a sample of automatic closes for quality review. Whatever you decide, document the threshold and the testing in your model risk and BSA/AML programs, since examiners will ask how alerts are closed.

Are amounts just under $10,000 enough to call it structuring?

No. FinCEN's SAR FAQs of October 2025 say that transactions near the $10,000 currency transaction report threshold do not, by themselves, require a SAR without information that they were designed to evade reporting. Grayson weighs the amounts with the rest of the record: deposits spread across branches and days, a customer asking how to avoid a report, explanations that change, and cash that the customer's income and business don't explain.

How is this different from the money mule recipe?

The money mule recipe answers one question in depth: whether an account is passing other people's money on, and whether the holder knows. This one triages any monitoring alert across typologies, including mule activity under fraud_proceeds. Send mule-shaped alerts to that recipe if you want the holder's role and the account action as well.

Detect money mule accounts

Whether an account is passing other people's money through, whether the holder knows, and what to do

Detect fraudulent incoming ACH credits and transfers

Release, hold or return an incoming credit that may be proceeds of BEC, account takeover or payroll diversion.

Recipes

Every use case, with its questions and cost per decision.

AML and sanctions

Transaction monitoring alerts, money mule accounts and sanctions and watchlist screening. Ready-to-run Grayson recipes with real responses, cost and latency.

Money mules

Decide whether an account is a money mule, whether the holder is complicit or was deceived by a job or romance scam, and whether to restrict or close it.

On this page

ExamplesCall it from your codeThe problemWhat to sendAdd your own policyWhere to call itCost and latencyEvaluate on your own dataFAQCan Grayson close alerts without an analyst?Are amounts just under $10,000 enough to call it structuring?How is this different from the money mule recipe?Related recipes