Three million transactions a day, screened for sanctions and PEP exposure before the next block clears. Real-time AML that flags less and catches more.
AML controls are worthless if they arrive after the money moves. We pushed sanctions and PEP screening inline into the Flink pipeline so every party is cleared in under 100ms, before the transaction settles.
OpenSearch carries the fuzzy-matching load against OFAC, UN, EU and PEP lists, while Flink's keyed state handles velocity and structuring detection across the live stream without a round-trip to a database.
Legacy rule engines flag everything and trust analysts to dig out the truth. We replaced brittle thresholds with a scikit-learn ensemble that scores behavioral, network and velocity features together.
The result is asymmetric: a 70% drop in false positives alongside a 35% lift in true positives. Less noise and more signal at the same time, which is the only outcome a compliance team actually cares about.
| Component | Technology | Why |
|---|---|---|
| Stream processing | Apache Flink | Stateful, exactly-once processing at 3M+ tx/day with low latency |
| Watchlist index | OpenSearch | Fuzzy name matching across sanctions + PEP lists in <100ms |
| Risk model | scikit-learn | Ensemble scoring tuned to cut FP without dropping TP |
| Case + audit store | PostgreSQL | ACID lineage for every alert, case and filed SAR |
| Glue + services | Python | Single language across ingest, ML, screening and SAR generation |
Every transaction is risk-scored as it arrives, not in an overnight batch.
Name, alias and transliteration matching against OFAC, UN, EU and PEP watchlists.
Stateful Flink operators catch smurfing and rapid-movement patterns across windows.
Links fragmented counterparty identities into a single risk subject.
Confirmed cases auto-draft regulator-ready filings with narrative and evidence attached.
Every alert, score and decision is reconstructable in PostgreSQL for examiners.
“Flag less, catch more, 70% fewer false positives and 35% more real hits, decided in under 100 milliseconds.”
The system turns AML from a backward-looking audit chore into a real-time control surface. Three million-plus transactions a day flow through inline sanctions and PEP screening, an ensemble risk model and automated SAR filing, all under 100ms per decision. By cutting false positives 70% while lifting true positives 35%, it gives compliance teams something rare: a monitoring pipeline that is both faster and more accurate, with a complete audit trail for every regulator who asks.