Use casesFinancial institutions & fintech

  • Every financial institution

Suspicious activity review

Monitoring scenarios raise alerts on transfers, cash, and accounts every day; each needs an analyst to rebuild the customer's story before anyone can judge suspicion.

With the systemEach alert ranked, its evidence gathered, the narrative drafted with sources; the compliance officer decides.

Who decides
Compliance officer

AML monitoring · alert · 4 November 2026Illustrative

Scenario: funds in and out the same day · retail customer

Over two weeks the account of A*** Y*** received dozens of small transfers from unrelated senders; most of the money was sent on within hours to two accounts at other banks.

→ far above the declared income · KYC: student

The document as it arrives. In red, what the system marks for your expert.

1. The work

Today

  1. AlertThe anti-money-laundering (AML) monitoring scenarios flag transfers, cash, and account behavior that does not fit the customer: many small transfers in from unrelated people and out the same day, cash split below a threshold, money passing straight through. Alerts queue in the order they arrived.
  2. GatherFor each alert an analyst opens the know-your-customer (KYC) record (occupation, declared income, risk rating), months of transactions, the counterparties, linked accounts, earlier alerts and reports, and screening results, screen by screen.
  3. WriteThe analyst writes the case narrative by hand: who the customer is, what happened, and why it does or does not fit the profile.
  4. ReviewUnder your alert policy, the analyst closes the alert with a reason or, where suspicion holds, escalates it to the compliance officer in an internal report, which is itself confidential.
  5. DecideThe compliance officer decides whether to file a suspicious transaction report (STR) with MASAK, the financial intelligence unit, within ten working days of the suspicion forming; no one may tell the customer.

With the system

  1. AlertThe alert-priority model ranks each alert by how likely your reviewers are to escalate it, with reason codes; it changes the order of the queue, and your policy lets no alert close on its score.Model
  2. GatherThe agent runs the evidence checks at once through read-only systems (profile, transactions, counterparties, linked accounts, earlier alerts and reports, screening) and builds one review file, each fact citing its system.Agentic AI
  3. WriteThe SLM drafts the narrative from the file only; a checker ties every sentence to a cited fact and sends back any it cannot, until the draft passes or a round limit stops it.SLM
  4. ReviewThe AML analyst reads the file and the narrative, corrects them, and, under your alert policy, closes the alert with a reason or escalates it to the compliance officer, as before.Person decides
  5. DecideThe compliance officer decides whether to file an STR with MASAK and files it; suspicious-activity reporting stays a person's, and nothing in the system tells the customer.Person decides

What lands on the desk

The analyst opens one file instead of seven screens: the alert is ranked, every check has run, each fact names its system, and the narrative is drafted with a source for each sentence. Closing or escalating stays the analyst's; the report stays the compliance officer's, and the file shows whether the clock has started.

FIG. 1 · Suspicious activity review fileIllustrative
Monitoring alert · retail customer · 04.11.2026Many transfers in, moved out the same day

Model · alert priority

Highnear the top of today's queue

  • Transfers in from many unrelated senders
  • Balance moved out within hours
  • Activity far above the declared income

Agent · parallel checks, read-only

  • ProfileStudent, low declared income, account opened recentlyKYC
  • InDozens of small transfers from unrelated people in two weekstransfers
  • OutMost of it sent on within hours to two accounts at other bankstransfers
  • NotesTransfer descriptions carry first names and codes, no purposetransfers
  • ScreeningNo sanctions or watch-list hitscreening

SLM · draft narrative, every sentence cited

The account receives many small transfers from unrelated people and sends most of it on within hours, which does not fit a student's declared income. The draft states the facts; it draws no conclusion on suspicion.

Status

  • Internal report to the compliance officerthe analyst's
  • Ten-working-day clockstarts when suspicion is recorded
  • Model
  • SLM
  • Agent

Why a person decidesWhether there is suspicion, and whether to file an STR, is the compliance officer's; no one may tell the customer.

DecidesCompliance officer

2. The system

For your technical team — skip it if you like.

How it works

In

  • Monitoring alerts and the scenario that fired
  • Transfers, cash, and transfer descriptions
  • KYC profile and risk rating
  • Earlier alerts and their outcomes

  1. Model · estimates

    Alert-priority model

    Gradient-boosted or logistic, chosen on out-of-time evidence

    Reads

    • Everything under In

    Out

    • Escalation likelihood per alert
    • Reason codes
    • The queue in that order

  2. Agent · prepares

    Evidence-gathering agent

    Parallel checks, read-only

    Reads

    • The alert and its rank

    Out

    • Profile: occupation, income, risk rating
    • Transactions and counterparties in the window
    • Linked accounts, earlier alerts and reports
    • Sanctions and watch-list screening
    • One review file, each fact cited

  3. SLM · understands

    Narrative writer

    Fine-tuned SLM; checked and revised against the file

    Reads

    • The review file
    • Your narrative template

    Out

    • A case narrative, each sentence cited
    • What fits the profile and what does not
    • Facts still missing, marked

  4. Decision

    AML analyst, then compliance officer

    Reads

    • The file and the narrative

    Out

    • Under your policy, the analyst closes or escalates the alert
    • The compliance officer decides whether to file an STR
    • A filed STR reaches MASAK within ten working days of the suspicion
    • No one tells the customer
How the agent's work is arrangedParallel + Check and revise

Parallel

The evidence sources are independent and every alert needs all of them, so they run at once; the narrative then passes a check that ties each sentence to the file before a person reads it.

Check and revise

One step drafts; a second checks the draft against sources and rules, until it passes or a round limit stops it.

How the models are trained and tested

Your expert writes the test first. A step the test does not need is skipped, and we say why.

Show the training steps

Alert-priority model

  1. Target

    Whether your reviewers escalated the alert to the compliance officer: the model learns your team's past judgment, not proven laundering, which is why it only orders the queue.

  2. Data

    12–24 months of alerts with the analysts' outcomes, the scenario that fired, and the customer's profile and transactions.

  3. Method and challenger

    A logistic champion against a gradient-boosted challenger; the better one on out-of-time tests is used.

  4. Validation evidence

    How far down the ranked queue the escalated alerts sit, calibration, and stability out of time.

  5. Monitoring

    Monthly drift; each month a sample of low-ranked alerts is reviewed in full; a new scenario triggers a review of the model before it ranks that scenario's alerts.

Small language model (SLM)

  1. Test set

    200–400 past alerts with narratives your senior analysts grade for accuracy, citation, and the facts a compliance officer needs.

  2. Dataset

    Past review files and the narratives your team wrote; personal data masked in training copies, and files behind a filed STR kept under the same confidentiality as the report.

  3. Continued pre-training (CPT)If needed

    Only if the base model fails the test on banking and anti-money-laundering vocabulary.

  4. Supervised fine-tuning (SFT)

    On your narrative template: who the customer is, what happened, and why it does or does not fit.

  5. Reinforcement learning (RL)Skipped

    Skipped: whether a sentence matches its cited fact is checked by the checker and the analyst, not learned from a reward.

  6. Monitoring

    The analyst corrects every narrative; the corrections join the next test.

Where the agentic system stops

Under your alert policy, the AML analyst closes or escalates every alert; the compliance officer decides whether to file a suspicious transaction report with MASAK and files it within ten working days of the suspicion forming.

Show its tools, limits, and record
Tools and access
Read-only core banking, the AML monitoring system, KYC records, transfer and cash history, case management, and the screening service; writes only the review file and the draft narrative.
May not
Close an alert, file or decide an STR, block an account or hold a payment, close a sanctions or watch-list match, contact the customer or anyone outside the review, or grant itself any access.
Who decides and the written limit
Compliance officerUnder your alert policy, the AML analyst closes or escalates every alert; the compliance officer decides whether to file a suspicious transaction report with MASAK and files it within ten working days of the suspicion forming. Suspicious-activity reporting is always a person's. Your policy lets no alert close on a score, a sanctions or watch-list match never closes automatically, and nothing in the system tells the customer, or anyone else, that a report was or will be made.
Stops when
Any sanctions or watch-list hit or sign of terrorist financing goes straight to the compliance officer; a customer it cannot match with confidence, or missing data, goes to the analyst, marked.
Record
Every check and its source, the model's rank and reason codes, each narrative draft and the checker's findings, the time suspicion was recorded, and who closed, escalated, or filed; kept eight years.

How agentic systems stay inside limits

3. Value and conditions

Where the time goes, and what your institution will measure.

Where the value comes from

  1. Analyst time per alert.
  2. The likely cases reviewed first.
  3. Narratives that cite their evidence, consistent from analyst to analyst.

What your institution measures

  • Alerts reviewed per analyst per day
  • Time from alert to escalation
  • How high escalated alerts sat in the queue
  • Narratives the compliance officer sends back
  • STRs filed within the ten working days

Measured in the Decision Blueprint

Analyst minutes per alert and the time from alert to escalation, from your case log, set the baseline; your institution sets the target.

Conditions

The rules, the data, and the known error, with its guard.

  • Where there is any information, suspicion, or reasonable ground for suspicion that assets come from crime or serve terrorism, an obliged party reports it to MASAK whatever the amount, filed by its compliance officer where one is appointed; several transactions may be weighed together (Law 5549 art. 4/1; MASAK Tedbirler Yönetmeliği art. 27).
  • The report goes in within ten working days of the suspicion forming, with a further report when new findings emerge (Tedbirler Yönetmeliği art. 28). No one, the parties included, may be told that a report was or will be made, and internal reports to the compliance officer are confidential too (Law 5549 art. 4/2; Tedbirler Yönetmeliği art. 29), so the review file is open only to the review team and the compliance officer.
  • Transactions are watched against the customer's occupation, business, financial position, risk profile, and source of funds, with special attention to complex, unusually large, or purposeless ones (Tedbirler Yönetmeliği arts. 18–19); records are kept eight years (Law 5549 art. 8).
  • The model learns from your reviewers' past decisions and inherits their blind spots, so low-ranked alerts are sampled and reviewed in full every month. Data stays on your servers.

Start here

We replay a recent month of alerts with your analysts and compliance officer, time each check, read the narratives that reached the compliance officer, and see how the ranked queue would have ordered them.

Who builds it Every engagement is led by an engineer who has built machine-learning models that real decisions run on since 2012, and language models and agentic systems in production since 2024. About eqlx

Request a Decision BlueprintWhat the Decision Blueprint covers

Equalize the gap.

Bring work that takes expertise. Leave knowing the first step.

A short description of the work is enough; no confidential records.

Start with a Decision BlueprintTalk to the engineer

https://eqlx.ai/use-cases/suspicious-activity-review · Printed copy; the website is the current version.