Every suspicious report carries its hours remaining against the statutory deadline — five business days at MAS, three at AUSTRAC, two working days at the FIU — computed from the jurisdiction, not remembered by a person. Agents triage the alerts, screen the trades and draft the reports. Humans sign. Everything is evidenced.
No login. Fictional institutions; real regulators, laws, clocks and typologies. ⌘K searches anything, ⌘. opens the Demo Director.
Most platforms record when a report was filed. This one records when suspicion formed, computes the due moment from the jurisdiction's rule — business days, weekends, holidays, expedited triggers — and shows the hours left on every screen the MLRO opens.
| Jurisdiction | Report | Clock | Expedited | Legal basis |
|---|---|---|---|---|
| 🇸🇬 Singapore MAS · STRO | STR | 5 business days from establishing suspicion | 1 business day where a sanctioned party is involved | CDSA s.45; MAS Notice 626 as amended 30 June 2025 |
| 🇱🇰 Sri Lanka FIU-SL · CBSL | STR | 2 working days from forming suspicion | — | FTRA No. 6 of 2006 s.7; FIU Guideline 06/2018 |
| 🇦🇺 Australia AUSTRAC · APRA | SMR | 3 business days from forming suspicion | 24 hours where the suspicion relates to terrorism financing | AML/CTF Act 2006 s.41; Rules 2025 |
| Threshold reporting is carried too: TTR ≥ AUD 10,000 and IFTI within 10 business days at AUSTRAC; CTR and EFT ≥ LKR 1,000,000 at the FIU; cash movement ≥ SGD 20,000 in Singapore. Adding a jurisdiction is a data entry in domain/regimes.ts. | ||||
Each institution carries its licence type, prudential and AML regulator, reporting currency, and the supervisory priorities its regulator has published for this cycle. Switch workspace and the whole platform rebinds — including the clocks.
Straits Commercial Bank — full bank, D-SIB, SGD 186Bn. Merlion Wholesale Bank — commodity trade finance.
MAS Notice 626 (amended 2025, proliferation financing in scope), MAS TRM, FSM-N06 cyber hygiene, PDPA. Priorities: PF assessment, trust transparency, STR timeliness, trade finance controls.
Kandy Union Bank PLC — licensed commercial bank, 214 branches, the largest remittance book. Colombo Trade & Development Bank — tea, apparel and gem exports.
FTRA 2006, CDD Rules No. 1 of 2016, FIU guidelines; FTR Bill 2026 on the horizon. Priorities: CDD quality, two-day STR window, TBML through import/export corridors.
Southern Cross Mutual Bank — member-owned ADI, regional cash structuring. Pacific Rim Bank Australia — 48 correspondent relationships into Asia-Pacific.
AML/CTF Act and Rules 2025, APRA CPS 230 and 234, Privacy Act. Priorities: SMR quality under the new Rules, board oversight, correspondent transparency, operational resilience.
A score a bank cannot explain to its regulator is worse than no score. Every rating, every alert disposition and every trade hold in this platform carries the factor, indicator or typology that produced it.
Risk ratings built additively from country, type, PEP status, adverse media, ownership opacity, source of wealth, products, channel and behaviour drift — every point with its reason attached. Simplified, standard and enhanced tiers.
Structuring, rapid movement, unusual cash, round-tripping, high-risk corridors, dormant reactivation, third-party payments, velocity. Sentinel proposes a disposition with confidence and rationale; the analyst decides.
Triage → investigation → review → decision → filed. Suspicion is timestamped the moment it forms, and that timestamp — not the filing date — is what the clock runs from. Scribe drafts the narrative; the MLRO signs.
Every presentation screened for unit price against reference, document consistency, corridor, vessel, dual-use goods, third-party payment, shell indicators and free-trade-zone exposure. Tracer names the indicator that fired.
UN, OFAC, MAS, DFAT, EU, UK OFSI, PEP and adverse media. A confirmed match freezes the relationship and — in Singapore — starts the one-business-day STR clock under the amended Notice 626.
Seventeen Basel-aligned categories — credit through reputational, with AML/CTF, TBML, sanctions and fraud as their own lines. Inherent, control quality, residual, appetite, trend, and a flag for what the regulator is looking at this cycle.
“The only question a compliance officer actually asks about AI is who signs it. Here the answer is in the interface: a pending agent run cannot touch a regulated record until a named person decides — and that decision is on the ledger forever.”
Everything reads through one DataSource interface. The demo binds an in-memory seed; production binds an HTTP client against a published OpenAPI contract. The domain layer — risk rating, alert scoring, the TBML engine, the case machine, the clock arithmetic — has no React and no I/O in it, and lifts into a backend service unchanged.
Load your frameworks and controls through the same types the demo uses, point two source systems at Prover and Sentinel, and the first alert triage runs against your own customers. The platform is built; the engagement is the connection.