Introducing Complead. One AI-native platform for financial crime compliance. Read the story
New Ready Integrations available Check the new integrations
Product · Monitoring

Transaction Monitoring

Monitor transactions as they move, not overnight. Detect the typologies&patters your sector actually faces from a library that ships ready, prove a rule works against your own history before you publish it, and take a case from alert to filed report in one place.

Real-time ALERTS IN THE STREAM, NOT THE MORNING
Backtested EVERY RULE, AGAINST YOUR OWN HISTORY
Ready by sector Scenarios THAT SHIPped as CONFIGURED
Alert to filing From Ready rules to SAR IN PLACE
Why this matters

You know what your monitoring caught. You have no idea what it missed.

Every other control tells you when it failed. A screening match is right or wrong, and you find out. Monitoring never closes that loop: the pattern nobody wrote a rule for produces no alert, no case, and no record that anything happened. So programs grow the only way they can: by adding typologies written for someone else's business to transactions that settled last night.

The rules were written for a different business

Most libraries ship one generic set. A payments firm inherits patterns designed for a retail bank, and the ones it actually faces were never in the box.

Detection runs after the money

Overnight batch means the pattern surfaces once the funds have moved on. The alert describes something you can no longer act on.

No rule ever proves itself

A scenario runs for years without anyone measuring what it found. Adding one is safe; changing one is a gamble; removing one is unthinkable.

Case starts from nothing

The platform already held the transactions, the counterparties, and the pattern. The analyst assembles them again, by hand, into a narrative.

How it works

Four steps, from a transaction to a suspicious activity report

Scroll to advance
  1. Step 01 Define the rule, and simulate it before it runs

    Start from a ready library shipped that configured for your sector, or write your own conditions with Natural Language and AI, thresholds, and time windows. Then run it over your history and see what it would have done: how many alerts, how many real cases, what coverage nothing else provides. Nothing goes live on an assumption.

  2. Step 02 Connect the data, by file or by API

    Stream transactions through the API as they settle, or deliver them as batch files on your own schedule. Both paths feed the same engine, so a firm running real-time payments and a firm sending nightly files get the same detection, at the speed their infrastructure allows.

  3. Step 03 Investigate the transaction and the customer together

    An alert opens as a case with the picture already assembled: the transactions that triggered it, the customer's risk assesment, their screening position, the ownership chain behind them, prior alerts, and every counterparty involved. Notes, evidence and decisions stay on the case.

  4. Step 04 Report it, in the format the authority expects

    The narrative is drafted from what the case already contains, with the supporting transactions attached and the approval chain recorded. Review, amend, approve and submit without moving to another system.

complead / ingest
  • mule pattern v4draft
  • CONDITIONS4 set
  • WINDOW7 days
  • SIMULATED12 months
  • ALERTS1,840 → 610
  • CASES CAUGHT14 of 16
  • PUBLISHv4
complead / score
  • Sources2 connected
  • APIlive, 40 ms p95
  • FILEdaily, 03:00, SFTP
  • EVALUATED4.2M today
  • ALERTS118
complead / alert
  • CASE #4102 Delta Corp, HIGH 78
  • TRIGGER mule pattern v4
  • TRANSACTIONS 34, 7 days
  • SCREENING PEP, layer 4
  • KYB new shareholder, 31%
  • COUNTERPARTIES 4 of 12 flagged
  • ASSIGNED analyst, 14 MAR
complead / tune
SAR #2026-0417 ~ goAML NARRATIVE ~ drafted from case TRANSACTIONS ~ 34 attached REVIEWED ~ analyst, 14 MAR APPROVED ~ MLRO, pending SUBMITTED ~ awaiting approval Apply
DEFINE
CONNECT
Alert
REPORT
Capabilities

What the product actually does

01

Rules that ship ready for your sector

A payments firm and a high-street bank operator face different patterns, so they receive different libraries. Each typology arrives pre-parameterized, mapped to FATF and regional guidance, and documented with the reasoning behind its thresholds. The first week is spent tuning rather than writing.

02

A rule builder for what the library does not know

Conditions, thresholds, time windows, peer comparisons, and customer attributes, written in the interface with No-Code Interface. Your business has patterns nobody has published a typology for, and describing one should not require a release cycle.

03

Simulation before publication

Any rule, new or changed, runs over your own history before it goes live. Alert volume, cases still caught, and coverage unique to that rule are shown against the version it replaces. Turning a scenario off stops being a political decision and becomes an evidence-based one.

04

Real-time or batch, on one engine

Transactions are evaluated as they arrive through the API in real time or delivered as files on your own schedule. Same rules, same engine, same case output, at whatever speed your infrastructure runs.

05

Case management built for the investigation

Alerts arrive as cases with the rating, screening position, ownership chain, prior alerts, and counterparties already attached. Assignment, notes, evidence, escalation, and the decision stay in one place, with every action timestamped and attributed.

06

SAR and STR generated from the case

The narrative is drafted from the existing investigation, in the format the receiving authority expects, with supporting transactions attached and the approval chain recorded. Filing happens where the work happened.

Product tour

Write it, prove it, run it, work it, measure it, file it

Describe the rule, watch it build itself

Type the logic the way you would explain it to a colleague. Nova lays out the conditions and explains what it built, and every node stays editable by hand.

  • Plain language in, a real rule out
  • Conditions, thresholds, and windows laid out visually
  • Reasoning written alongside each node
  • Editable by hand, no black box
complead / live-feed
flag accounts receiving over 200k from 5+ new counterparties in 48h Apply
  • NODES BUILT4
  • WINDOW48h
  • COUNTERPARTIES≥5, new
  • STATUSdraft, editable
  • NODES BUILT 4
  • WINDOW 48h
  • COUNTERPARTIES ≥5, new
  • STATUS draft, editable

Why this alert fired

A ready library shipped that has been configured for your industry, with each scenario documented with the reasoning behind its thresholds.

  • Pre-parameterised by sector
  • Mapped to FATF and regional guidance
  • Rationale and thresholds documented
  • Simulate before you switch one on
complead / alert-detail
  • PAYMENTS LIBRARY 38 scenarios
  • RAPID PASS-THROUGH ready
  • TOP-UP AND EXIT ready
  • AGENT CONCENTRATION ready
  • CORRIDOR VOLUME enabled
  • REFUND ABUSE enabled

Real-time or batch, one engine

Stream transactions through the API as they settle, or deliver files on your own schedule. Same rules, same output.

  • API scoring on ingest
  • Batch file delivery, your schedule
  • Both paths have identical detection
  • Throughput and latency are visible
complead / rule-tuning
  • Sources2 connected
  • APIlive, 40 ms p95
  • FILEdaily, 03:00, SFTP
  • EVALUATED4.2M today
  • ALERTS118

The customer, not the transaction

An alert opens as a case with the picture already assembled, and the reason stated in language a reviewer can repeat.

  • The rule and version that raised it
  • Every transaction in the window
  • Rating, screening and ownership attached
  • Notes, evidence and assignment on the case
  • Case #4102Delta Corp, HIGH 78
  • TRIGGERlayering v2, 6h
  • TRANSACTIONS14
  • SCREENINGPEP, layer 4
  • KYBnew shareholder, 31%
  • COUNTERPARTIES2 of 9 flagged
  • ASSIGNEDanalyst, 14 MAR

Which rules earn their alerts

What each scenario has actually produced, and what a change would do before you make it.

  • Alerts, cases and filings per rule
  • False-positive rate, per scenario
  • Backtest a change from this screen
  • Publish a version, or roll back
  • layeringv2, 90 days
  • ALERTS214
  • CASES7
  • FILINGS2
  • FP RATE96.7%
  • ALERTS214 → 96
  • CASES7 → 7

From case to submitted report

The narrative drafted from what the investigation already contains, in the format the authority expects.

  • Narrative drafted from the case
  • Supporting transactions attached
  • Format of the receiving authority
  • Reviewer and approver recorded
  • SAR #2026-0417goAML
  • NARRATIVEdrafted, 340 words
  • TRANSACTIONS34 attached
  • REVIEWEDanalyst, 14 MAR
  • APPROVEDMLRO, pending
Rule builder

Describe the rule, watch it build itself

Type the logic in plain language. Nova lays the nodes on the canvas and explains what it did, and every node stays editable by hand.

Consortium DB

The pattern will hit you on next quarter is hitting someone else now

Institutions learn about new patterns alone, each one after its own loss. Confirmed typologies arrive here as ready-to-backtest scenarios you can switch on. The detection logic travels across the network. Customer data never does.

Confirmed patterns, not theories

A scenario enters the library after an institution has worked it into real cases. What you receive has already produced findings somewhere, which is a different thing from a typology paper describing what might happen.

Test it on your own history first

A shared scenario is a draft until you simulate it. Alert volume, cases it would have caught, and coverage that nothing else provides, measured on your transactions before they touch your queue.

Nothing leaves your tenant

Your customers, transactions, counterparties and thresholds stay yours. Only anonymized pattern logic moves, and contribution is opt-in, per rule, decided by you.

Guidance mapped to the rules it affects

FATF, EBA, and local regulator updates are linked to the scenarios they touch, so a change in guidance arrives as a list of rules to review rather than a document to interpret.

Runs on Fusion

Behaviour is the largest weight on the Fusion score

Transaction behavior feeds the same customer risk score as screening and ownership, so a rising monitoring score pulls a customer into review across the whole program rather than only inside this module. And the score comes back the other way, setting the thresholds against which this customer is monitored.

This product Client & Payment Screening Gives a behavior change that triggers an immediate rescreen. Takes back a sanctions and PEP position on the customer and every counterparty in the alert.
Feeds into KYB & UBO Gives behavior that contradicts the declared structure. It takes back the ownership chain, so a payment inside your customer's own group is recognized as a related-party transfer rather than an ordinary counterparty.
You get Customer Risk Assessment Apply different rules for different customer segments. Gives behavior measured against what the customer declared at onboarding. Takes back the tier, which sets the thresholds this customer is monitored against.
You get Adverse Media Gives the counterparties worth searching for. Takes back reported conduct on them, so an alert arrives knowing whether the other side has been named anywhere.

Backtest a rule you already run

Bring twelve months of transaction history and one scenario you have never been able to justify changing. In 30 minutes, you will see what it caught, what it cost, and what a tuned version would have done instead.

Ready by sector SCENARIOS THAT SHIP CONFIGURED
Simulated EVERY RULE, BEFORE IT GOES LIVE
Real-time or batch ONE ENGINE, EITHER WAY
Integration

Stream transactions in, get alerts out

Post transactions as they settle or deliver them as files. Alerts arrive as events with the rule, the version, and the reason attached.

// send a transaction for monitoring
POST /v1/monitoring/transactions "customer_id": "4102", "amount": 24000, "currency": "EUR", "direction": "credit", "counterparty": "acc_9931"
200 OK · scored · no alert · 40 ms
// receive behavioural alerts
PUT /v1/monitoring/webhooks "events": ["alert.raised","alert.escalated","case.opened","filing.submitted"], "url": "https://you.example/tm-alert"
200 OK · 28 ms
Case study · E-money

An e-money firm cut alerts by half and caught more real cases

Rule-only monitoring buried analysts in false positives. After adding AI scoring against each customer’s baseline, alert volume fell and confirmed cases rose, because the alerts reflected the pattern.

−52% Alert volume
+30% Confirmed cases
Real-time Scoring
Read the case study
FAQ

Before you ask us

Do we get rules ready, or do we write them ourselves?

Both. A library shipped configured for your sector runs from day one, each scenario pre-parameterized, mapped to FATF and regional guidance, and documented with the reasoning behind its thresholds. From there, you write your own patterns for which nobody has published a typology.

How does this relate to fraud prevention?

Transaction monitoring answers whether behavior should be reported over days and weeks. Real-time fraud prevention answers whether a payment should be allowed in milliseconds. Both run on the same customer record.

See Real-Time Fraud Prevention →
Can we test a rule before it goes live?

Any rule, new or changed, runs over your own transaction history first. Alert volume, cases it would still have caught, and coverage unique to that rule come back as numbers, shown against the version it replaces.

How do we justify turning a scenario off?

Performance is measured per rule or customer: alerts raised, cases opened, filings produced, and false-positive rate. A scenario that has never converted is visible as such, and backtesting shows what it would have missed if retired. The decision is recorded with the evidence behind it, which is what makes it defensible rather than political.

Does it monitor in real time?

Transactions are scored on ingest, so a pattern raises an alert while the activity is still current. Batch delivery by file is supported on the same engine, for firms whose infrastructure works that way.

How does it reduce false positives?

Partly by scoring against each customer's own baseline, so ordinary behavior for that customer does not fire. Partly by letting you tune from inside the alert that prompted you, and prove the change in history before publishing it.

What is the shared scenario library?

Typologies confirmed by other institutions arrive as ready scenarios you can backtest and switch on. Only anonymised pattern logic moves across the network. Your customers, transactions, counterparties and thresholds stay in your tenant, and contribution is opt-in per rule.

Is the AI score explainable?

Every alert shows the rule and version that raised it, the transactions in the window, the counterparties involved and the reason stated in language a reviewer can repeat. Nothing fires on a number alone.

Can the AI write a rule for us?

You describe the logic in plain language and Nova lays out the conditions, thresholds and windows on the canvas with its reasoning written alongside each node. Every node stays editable by hand, and the rule still goes through simulation and approval before it runs.

Does the product produce SARs and STRs?

Yes. The narrative is drafted from what the case already contains, in the format the receiving authority expects like goAML, FINCEN, , with supporting transactions attached and the approval chain recorded.

Do thresholds differ by customer type?

Rules read the customer's rating, segment, and declared expectations, so the same scenario behaves differently for a merchant and a retail savings customer.

Does behaviour affect the customer risk score?

It is the largest weight in the Fusion score, so a rising monitoring score pulls a customer into review across the whole program rather than only inside this module.

See how it is easy to apply a new scenerio

Which of your scenarios has never produced a filing? Bring a year of history and we will run it, along with a tuned version, and show you the difference.

Ready by sector SCENARIOS THAT SHIP CONFIGURED
Simulated EVERY RULE, BEFORE IT GOES LIVE
Real-time or batch ONE ENGINE, EITHER WAY
Testimonials

What compliance teams say

All case studies
Complead provides ultimate control via its case management and safelist systems. Automated API operations significantly reduced my team's manual workload.
Tarık Özat Internal Control & Compliance Director · Moka United
Using the API we run AML controls automatically and stay compliant, while reducing our team's daily workload.
Onur Ergüney Global Partnership, Gaming & E-Sport · TPay
With Complead we offer fast, easy, secure onboarding. We focus on real risks, not false positives.
Arda Akay Head of Compliance, Risk & Internal Control · BPN