Live demo

Watch an alert become a verdict.

A high-risk case, worked step by step, tool by tool, score by score. Then the case files behind it, each replayable byte for byte.

Alerts are raised by the overnight batch; this is what happens to each one before your analyst arrives.

A guided pass through one investigation: from evidence to a signed, filed verdict. Hands-free; press Esc to exit and explore freely.

Deterministic replay: same inputs, same verdict.

The agentic investigation

Alert in. Verdict out.

Press Run. The master agent works the alert tool by tool; the deterministic engine fuses one score. The final call stays with your analyst.

Master AML Agent · agentic investigation 00:00
Name Transaction Counterparty Company Entity Invoice Media Σ Fusion
Master AML Agent

Press Run to watch the tools fire and the engine settle on a verdict, or skip straight to the result.

Gate · SME flags · model only when warranted

The agentic investigation files · four cases

Four files. Every claim, corroborated.

An onboarding, a sanctions tripwire, a source-of-wealth write-up, and one customer across two rails. Open any card to read the full file.

Illustrative case files · synthetic data · fictional names · real architecture. Every step is replayable, byte for byte.

Onboarding #GSA-2026-0492

"A customer signs up."

A new corporate customer uploads a trade licence, passport and bank statement: photographed, skewed, one page handwritten. The documents are read first; then the checks run on the facts.

File A

"A customer signs up."

#GSA-2026-0492 Onboarding

A new corporate customer applies. They upload what customers always upload: a trade licence, a passport, a bank statement, photographed, skewed, one page handwritten.

  1. 01
    Document intelligence reads the papers first, each one straightened, scanned, every extracted field carrying its page and region: TRADE LICENCE p.1 §2 PASSPORT MRZ STATEMENT p.3. One handwritten figure resolves at low confidence; it is not guessed, it is flagged: LOW CONFIDENCE · HUMAN REVIEW. Then the checks run on the facts: culture-aware name screening scores Md Abdul Rahman b. Yusuf and Mohammed Abdulrahman bin Yousef at 0.93, the registry confirms the company, and a one-hop graph surfaces an address shared with a confirmed 2025 case.Association is a flag, never a verdict.
  2. 02
    The verifier reads over the model's shoulder throughout, and any sentence without a record turns yellow. Then the engine decides: every signal fused under versioned weights. CLEAR opens the account in under 90 seconds; REFER lands a fully-cited file on an analyst's desk. The regulator can replay either outcome, byte for byte.
Replay panel DOCS IN → EXTRACT (cited) → SCREEN 0.93 → GRAPH HOP → DEEP SWEEP → ENGINE: REFER → ANALYST
Sanctions tripwire #GSA-2026-0475

"The wrong Meridian."

A payment counterparty's name matches an SDN entry exactly, string for string. The wire trips in milliseconds, and the identifiers that tell namesakes apart are lined up for a human.

File B

"The wrong Meridian."

#GSA-2026-0475 Sanctions tripwire

A payment counterparty's name matches an SDN entry, exactly. String for string.

  1. 01
    The wire trips in milliseconds: no model weighed it, no score ranked it. An exact sanctions match is a mandate: mandatory human review, always, sitting above the ranked queue in a band of its own: MANDATE · FORCE REFER · n/a · tripwire. While it waits, the system lines up the identifiers lists rarely make easy: DOB 1961 on the list vs 1974 on file; different nationalities; the listed entity dissolved 2015, the customer incorporated 2019, each line cited to LIST · OFAC-SDN KYC FILE REGISTRY.
  2. 02
    The dossier assembles into two columns (corroborating identifiers on the left, discriminating on the right) and reads:conflict, likely namesake.A senior reviewer opens a two-hour investigation already finished. No score, no recommendation: a mandate is a tripwire; a senior confirms identity and decides. Release or escalate. On the record, replayable, forever.
Replay panel EXACT MATCH → TRIPWIRE → DOSSIER: 2 COLUMNS → TIER: CONFLICT → SENIOR DECISION
Source of wealth #GSA-2026-0466

"A source-of-wealth file, writing itself."

A private-banking prospect declares AED 40M from a business sale and an inherited property. The write-up that costs two weeks assembles in front of you, until one line finds no record.

File C

"A source-of-wealth file, writing itself."

#GSA-2026-0466 Private banking

A private-banking prospect declares AED 40M: a business sale and an inherited property. The write-up that normally costs a relationship manager two weeks of document ping-pong assembles in front of you.

  1. 01
    The planner maps what each claim needs; document intelligence reads the sale agreement and financials, the registry investigator confirms the directorships, the evidence matcher pairs every claim to its proof. Sentence by sentence, each line locks in with its receipt: the business sale SALE AGREEMENT p.4; the matching credit BANK STATEMENT Q3; the directorships REGISTRY 2019–2024.
  2. 02
    Until one line, the inherited property valued at AED 12M, finds no record behind it. It doesn't disappear and it doesn't get dressed up; it turns yellow: NO SUPPORTING RECORD · REQUEST VALUATION. The document chaser sends the request from a bank-approved template (the AI never composes free text to a customer), the case clock pauses, and one document later a senior countersigns. Done in days, not weeks.
Replay panel CLAIMS MAPPED → EVIDENCE PAIRED → 1 LINE YELLOW → RFI (TEMPLATE) → CLOCK PAUSED → CLEARED
Fiat + crypto #GSA-2026-0472

"One customer, two rails."

A licensed digital-asset firm's customer moves USD 120,000: fiat in, crypto out. Two rails, one case file: your own chain-analytics licence testifies as cited evidence.

File D

"One customer, two rails."

#GSA-2026-0472 Licensed virtual assets

A licensed digital-asset firm's customer moves USD 120,000: fiat in, crypto out. Two worlds, one case file.

  1. 01
    The fiat leg reads like any other: corridor, counterparty, history, the rule engine's versioned thresholds. The crypto leg arrives as evidence, not adventure: the customer's own licensed chain-analytics provider reports the counterparty address as high-risk, category named, and the finding enters the file as one more cited fact: WALLET INTEL · via your chain-analytics licence. Corrobo never traces chains itself; it makes your existing tools testify in one governed case.
  2. 02
    One tripwire watches this rail too: a customer address matching a sanctions-listed digital-asset address (an exact string, no fuzziness) is a mandate like any other. FORCE REFER. Then the engine fuses both rails under one breakdown: fiat signals, wallet exposure, graph. One score, one queue, one analyst with the complete picture: bank rails and blockchains in the same sentence, with the same receipts.
Replay panel FIAT LEG → WALLET INTEL (LICENSED) → ADDRESS CHECK → ONE FUSED FILE → ANALYST

Now run it on your own alerts.

Bring up to 5,000 historical alerts. Two weeks later you're reading your own numbers, not our brochure.

Book a pilot