System Architecture
Diagram
Full production architecture: 8 layers from signal ingestion through regulatory filing. 5 parallel agents, 5 peer source tools, graph-based correlation engine, mandatory HITL gate. Architecture v2.1 · Fraud Detection Agentic AI.
Consumes normalized event. Classifies fraud type based on event signature: ATO (credential + new device + wire), BEC (first-time payee + wire + email metadata), Synthetic (SSN anomaly + credit velocity), Mule (P2P flow + device clustering).
Dispatches all 5 source tools and all 5 agents simultaneously. Not sequentially — parallel execution. Each agent receives the same normalized event record. Total dispatch latency: <50ms.
Real-time · <200ms
36-Month Baseline
Sardine · Session
FFIEC · CFPB
SAR Pre-fill
Produces 0–100 risk score from XGBoost ensemble (tabular features) fused with GNN output (graph topology). Returns: risk score, top contributing features (SHAP values), GNN neighborhood risk propagation map, mule network indicators.
Retrieves 36-month baseline from FIS/Fiserv. Computes deviation scores for: amount (raw + percentile), velocity (24h/7d/30d), payee concentration, geographic access, login frequency. Returns: baseline summary, deviation vector, ATO probability, risk trajectory chart.
Queries BioCatch, ThreatMetrix, and Sardine APIs with session correlation token. Returns: behavioral risk score (0–100), device fingerprint match/mismatch, session anomaly type (credential stuffing/RAT/bot-overlay), device-to-account history.
Applies deterministic regulatory rules to the event. Returns: Reg E obligation (yes/no/complex), 5-day clock start timestamp, SAR obligation (yes/no), CTR threshold exceeded (yes/no), OFAC blocking required (yes/no), all deadline timestamps.
Assembles all agent outputs into a complete HITL decision packet. Produces: fraud narrative (plain-language summary with evidence citations), SAR narrative draft (FinCEN field-compliant), Reg E determination memo, evidence exhibit package, priority classification (P0/P1), all regulatory deadline display fields. Writes back to Actimize/Verafin via REST API.
Graph-based signal fusion combines all 5 agent outputs into a unified confidence score. Conflicting signals are resolved by weight matrix calibrated to fraud type. ATO weight profile differs from BEC and Mule weight profiles.
Assembles ordered evidence chain with confidence annotation. Each signal is ranked by contribution weight. Low-confidence signals are flagged for analyst attention rather than excluded. Chain is fully reproducible for examination.
Plain-language fraud case narrative for analyst and examiner use. Cites specific evidence. Explains fraud mechanism and signal correlation.
FinCEN BSA SAR form pre-populated. All required fields completed. Subject information, transaction detail, suspicious activity description all drafted.
Reg E determination memorandum: unauthorized transaction analysis, applicable provisions cited, provisional credit recommendation with regulatory basis.
Complete evidence exhibit package: agent output summaries, signal weights, source citations, confidence annotations, timeline of events.
The HITL gate is a hard architectural boundary. No regulatory action proceeds without explicit Fraud Analyst approval. This layer cannot be bypassed, configured for auto-approval, or overridden by any system setting. The 5 gates are hardcoded at the system level.
FinCEN BSA E-Filing API (31 U.S.C. §5318(g)). BSA Officer is filer of record. SAR number returned and logged. T-30 deadline satisfied.
Provisional credit applied in core banking (12 C.F.R. §1005.11). Customer notification generated. 5 business-day compliance logged.
FinCEN CTR E-Filing for qualifying cash events (31 CFR §1010.311). 15 calendar-day deadline satisfied. Pre-populated from transaction data.
Form TDF-90-22.50 submitted to OFAC (31 CFR §501.603). Account blocked in core banking. 10 business-day deadline satisfied.
Signal ingestion (L1) and HITL gate (L7) — the entry and mandatory human checkpoint. Red denotes the highest urgency layers.
Source tools (L3) and agents (L4) — both layers execute in parallel. 5 tools and 5 agents run simultaneously, not sequentially.
Claude Sonnet LLM (L6) generates narrative, SAR draft, Reg E memo, and evidence chain from the correlation engine output.
Post-HITL filing layer (L8). SAR, Reg E credit, CTR, OFAC report. All submitted by authorized humans — never auto-filed by the agent.
External System Connections
Want a Walkthrough?
In the architecture call we map each layer of this diagram to your existing stack — core banking, fraud platform, behavioral biometrics provider, and regulatory filing workflow.