Frozen
every edit waits for a release
The pattern has advanced before the new rule reaches production.
Agentic AI · Fraud
Agentic Fraud Ops
Native to the platform, fluent in your fraud logic. Describe a rule in your own words, as simple or as layered as you need, and Canvas AI builds it. The agent then scores, branches, and routes every transaction alert on amount, channel, direction, country and customer risk.
Seconds
From sentence to live rule
No release
No engineering ticket in the loop
Dry run
Proof before it goes live
One record
The same customer AML sees
Why this matters
A fraud rule is out of date the week after it ships.
Thresholds set based on last year's volume are now being applied to this year's queue. To make a change, you usually have to submit a ticket, get a developer to handle it, make a release, and then lose a week. Canvas AI eliminates that process. All you have to do is write the change and it will be executed.
Blind
no safe place to test
Since tuning a live rule is risky, the rule remains unchanged.
Split
fraud and AML see different customers
Two systems, two verdicts, one customer, the same afternoon.
How it works
Scroll to advance
Say it, simulate it, switch it on
-
Step 01
A transaction trips a scenario
The alert includes the score, the amount, the direction, the channel, the country, and the customer's risk level, all of which are attached to the same record that your AML team is working on.
-
Step 02
The agent checks the record for this customer.
It compares the transaction with the customer's individual baseline and with the calls that your team has made in the past.
-
Step 03
Your rule applies to the branch.
Break down by amount, channel, or country; set a status, create a case, or send a webhook to your own system.
-
Step 04
You can see the result before it is counted.
Simulate it over a week with real traffic and examine each decision it would have made.
sanctionscanner / tm / alert
- Score78
- Amount24,500
- ChannelInstant
sanctionscanner / agent / decision
- DecisionEscalate
- Confidence81
- Deviation+320%
sanctionscanner / rule / builder
- If amount> 10,000
- And channelInstant
- ThenConvert to case
sanctionscanner / agent / dry-run
- Simulated4,182
- Would close2,740
- Would escalate61
Detect
Read
Decide
Measure
The rule builder
Write it, simulate it, publish it
Enter the rule in plain terms using your language, and Canvas AI will draw it on the same canvas, with the transaction fields serving as the conditions. A single sentence is sufficient. Keep it in dry run mode before publishing.
What the builder gives you
Change a rule before lunch, not next sprint
Visual rule canvas
Drag a trigger, a condition, and an action onto the canvas. No scripting, no deploy.
43 condition fields
Go by the confidence score, the match status, the risk level, the entity type, the amount, the channel, the number of articles, and the like.
11 operators
Equals, greater than, between, in, is true, and more. You can add conditions just as you would say them.
13 actions
Close, set status, set risk, assign, tag, note, notify, convert to case, send a webhook, switch monitoring on or off.
Branch and switch
Several outcomes on one canvas. Clear matches close, uncertain ones route, the rare hard ones escalate.
Dry run before live
Apply the rule to the live alerts within the simulation, and you'll see all the decisions it would have reached before any case moved.
What it leaves behind
Every decision leaves a trace
A silent fraud rule is essentially a postponed finding. Whenever the system runs, it stores the observations made by the agent, its decision process, and the changes it made, all under the agent's own username in your account. It is prepared for an examiner, not reconstructed for one.
Applied
Rule fired, action carried out
Logged
Dry run
Simulated on real traffic, nothing touched
Logged
Skipped
Rule fired, a guard stopped the action
Logged
Failed
Action did not complete; cause attached
Logged
Agentic AI
The rest of the agent suite
FAQ
Before you switch it on
Can we write a fraud rule in one sentence?
Yes. Describe it in your own words, as simple or as layered as you need, and Canvas AI builds it on the canvas. For example: if a customer transfers more than 100,000 within a month, add 30 to the risk score. Written and drawn rules follow the same grammar, so either can be edited.
Which transaction fields can a rule use?
Amount, channel, direction, country, customer risk and confidence score, among 43 condition fields. They combine with 11 operators, such as equals, greater than, between and in, so a rule can be as specific as the fraud pattern it targets.
How does the agent judge a transaction against the customer?
It compares the transaction with the customer's own baseline and with the calls your team made in the past on similar alerts. A transfer that is unusual for one customer can be routine for another, so the agent reads it against the person, not a single global threshold.
What can a rule do when it fires?
Set a status, create a case or send a webhook to your own system, among 13 actions. Branches let one rule close clear alerts, send unusual activity to an analyst and escalate likely fraud.
Can we simulate a rule on real traffic?
Yes. Simulate it over a week of real traffic and review every decision it would have made. Nothing is blocked and nothing moves until the rule is switched on, so tuning a live pattern stops being a risk.
Do we need an engineering release to change a rule?
No. You change the rule yourself, with no ticket, no developer and no release cycle. Fraud patterns move faster than a sprint, so the rule needs to change the day the pattern does.
Does fraud see the same customer as AML?
Yes. Every transaction alert sits on the same record your AML team works on. A mule account flagged by fraud is visible to AML at the same moment, not as a second investigation on a different version of the customer.
How are uncertain alerts routed?
Confidence is a number you branch on. Clear cases close, uncertain ones go to an operator and hard ones escalate. The thresholds are part of the rule, so they are visible, tested in dry run and changed on the record.
What is logged for each run?
What the agent saw, what it decided and what it changed, under the agent's own user in your account. Each run is marked applied, simulated, skipped or failed, so the trail is ready for an examiner rather than reconstructed for one.
What happens to past decisions when we switch a rule off?
Set the rule to draft and it stops immediately. The log stays, so every decision the rule made while it was live can still be reviewed and explained.
Run it against a day of your own traffic
Bring a sample file. We will draw one rule, simulate it and show you the alert volume it removes.
Minutes
To first rule
No code
To change one
Dry run
Before it touches a case