Ongoing Monitoring: Glossary of Key Terminology

Transaction Parties

• Beneficiary - The party that is on the receiving end of a transaction.
• Entity - An individual, business, or group whose activity is being evaluated.
• Counterparty - The opposite party in a transaction that are the evaluating entity, which can include both individuals and businesses. Every transaction has a counterparty. The party on the other side of a transaction, which could be the customer or a merchant, depends on the flow of funds.
• MSB - “Money Services Business” is any person or business doing cash-related activities such as currency exchange, issuing traveler/cashier's checks, money transmission.
• Source Account - Bank Account belongs to the Entity in evaluation, often the bank account created by the Entity with the FI.
• Destination Account: An account where the evaluating transaction is connected to, and owned by the counterparty.
• Linked/Funding Account - An account that is connected as the funding source of the account signed up by the customer with our client.
• UBO - “Beneficial Owner” is a person or persons who have significant ownership of an account through which the transaction is happening.

Transactions

• Funds-Through / Flow Through - An account with a low maintained balance, where full amounts are often rapidly withdrawn after deposited.
• Transfer Request - A function used for Transaction Interdiction. It allows the agent to update the status of a transaction within a case and trigger a webhook for the client to process/stop the transaction.

Cases

• Alert - Individual transactions that triggered a rule. Responsible for generating a case. The results of statements in the Workflow that can be used to drive subsequent actions within the Workflow. These can also be viewed as containers of business logic that the Activity Evaluation triggered. They are most commonly used to indicate which Rules were triggered during the Workflow.
• Case Type - A category of case (e.g. Compliance vs Fraud). Client can use this to distinguish the queue for agent review, as well as allowing multiple cases generated under the same entity when they have different case types.
• Case - Summary of alerts generated on an entity. A case requires agents to investigate historical activities on account to determine whether it is worthy of any government filings.
• case-generating tag - Tag used in a transaction-type workflow. Once triggered, it will generate a case if the entity does not have an open case in Case Management.
• Case Management - A queue that houses all cases generated on the entity. A dashboard, similar to the “Review Queue” for Onboarding, is used to review and act on all alerted behavior with the ability to add notes, attach documents, assign cases to agents or teams, change statuses and escalate while maintaining an audit trail of all activity.
• Suspicious Activity Report (SAR) - Suspicious Activity Report is a government filing required by FIs whenever they identify suspicious activity, often done after performing an investigation into the transactions/activity that alerted.
  • Banks need to file SARs with FinCEN directly.
• Suspicious Transaction Report (STR) - The main difference between a SAR and STR is the object of suspicion. For a SAR, the object of suspicion is the activity. Meanwhile, for a STR, the object of suspicion is the transaction - STR focuses on a specific transaction.
• Unusual Activity Report (UAR) - also known as Parabolic SAR (PSAR), it is mostly applicable for fintechs with a backing bank, compliance managers at the fintechs may “advise” the bank to file a SAR after investigating (without doing it themselves) - they file a “PSAR” for the bank to take further actions.
  • FinTechs working with banks are obligated to provide UAR (same set of information as SAR) to their respective bank. The format in which they provide the suspicious activity information will vary based on what they have agreed with their partner bank.
• Currency Transaction Report (CTR) - A Federal law requirement where financial institutions must report transactions over $10,000 conducted by one person in a single day.

Transaction Monitoring Workflow

• Account History - An Alloy internal service that is commonly used in Transaction Monitoring workflow. It provides account level information, such as age of account, PII changes etc.

• Average Amount - Average taking across individual transaction amount happened during the defined time range in MLA.

• Compliance Alert - Default outcome of a transaction workflow when any rule is flagged. This can be customized as any name under Setting by defining it as a Case Status.

• Consecutive Days / Rolling Period -

• Entity Account History - An Alloy internal service that determines number of linked account on an entity level.

• Evaluation - The result of an activity being run through a Workflow; Evaluations are containers of data that were gathered and assessed when this activity was being examined.

• Excessive Activity - Refer to an entity with a total aggregated total over a limit or over the threshold that considered as normal behavior

  This is often detected by using MLA: Sum of Transactions in the last x-days > $y

• Excessive Volume - Refer to an entity making too many transactions, or a specific type of transactions that is outside of normal behavior or over the limit.

  This is often detected by using MLA: Count of Transactions in the last x-days > y

• Input Attributes - Input attributes specified in the workflow represent data that you want to declare and pass to our API. After declaration, they may be included within threshold rules and output attributes in this workflow. Data that can be ingested directly from your data feed and used within a Workflow for more complex decisioning. For example, settled_at is commonly ingested to determine the timestamp for when the transaction was settled.

• Merchant Category Codes (MCC) - MCC are four-digit numbers that describe a merchant's primary business activity. Used by credit card issuers to identify the type of business in which a merchant is engaged. Most commonly used to track spending habits and to allot credit card points for qualified purchases (e.g., dining, groceries, gas, entertainment, etc.)

• Multi-Level-Attribute (MLA) - MLA is a tool for flexible aggregations of your Entities' activities, such as their historical transaction or account behavior; there are different types of MLAs that can aggregate different data.

• Outcomes - Configurable statuses that Evaluations can result in that can be used for downstream processes such as Case Management

• Output Attributes - Output attributes are calculated expressions that can ingest numerical data from other sources in order to output a new number in our API response. Intermediate calculations that can be used to supplement the rules engine by calculating metrics such as credit/debit ratios and excessive increases in activity.

• Rounded Transactions - Transaction with amount about that is rounded (e.g., rounded dollar is $1, $2; rounded to the thousands is $1000, $2000)

• Services - External services (such as LexisNexis) or internal Alloy services (such as Transaction History) that supply information to be evaluated in the workflow.

• Thresholds - Values that aggregations are compared against to attach an alert or trigger subsequent actions in the workflow.

• Transaction History - An Alloy internal service that is commonly used in Transaction Monitoring workflow. It allows aggregation of historical transactions on the entity level.

• Valid Historical Period - The period of time the MLA referenced from, to ensure the entity has enough valid data during this time period. (e.g. If an MLA looks at % Incoming vs Outgoing amount in the last 30-days, Valid Historical Period would be referencing 30-days prior to transaction date)

• Workflow - A configurable decision tree consisting of data integrations, MLAs, Attributes, and other components that makes up the logic for an Activity Evaluation.

Anti-Money Laundering Typology

• Account Takeover (ATO) - An attack whereby cybercriminals take ownership of online accounts using stolen passwords and usernames. Cybercriminals generally purchase a list of credentials via the dark web – typically gained from social engineering, data breaches, and phishing attacks.
• AML - “Anti-money Laundering” is a concept that refers to the laws or practices to prevent or identify individuals performing money-laundering activities.
• BSA - “Bank Secrecy Act” is the main US anti-money laundering regulatory act (Title 31, U.S. Code Sections 5311- 5355) that was enacted in 1970 and sets standards for money laundering reporting and record-keeping for Financial Institutes (FIs).
• Counterparty Sanction Screening -
• Currency Transaction Report - A report that all FIs are required to file with FinCEN for any transaction that exceeds $10,000.
• Customer Due Diligence - Processes designed to perform the necessary checks on any customer to ensure the legitimacy and understand the risks associated with retaining the customer.
• Disbursement - Means paying out money. The term disbursement may be used to describe money paid into a business' operating budget, the delivery of a loan amount to a borrower, or the payment of a dividend to shareholders.
• EDD - Enhanced Due Diligence
• FI - Financial Institute
• FinCEN - aka “Financial Crimes Enforcement Network,” is a primary government agency tasked with money laundering and terrorist financing cases.
• Fraud Model - A model generated by Alloy using AI/ML to detect possible instances of fraud based on account activity outside of pre-defined rules.
• Integration - Final stage of the money-laundering process. Funds are used for purchases.
• Layering - Second stage of the money-laundering process. Funds are moved around various financial institutions and/or accounts to obscure the source of the funds.
• Money Funneling - Illegal accounts that funnel “dirty” money made from crimes, such as human trafficking, human smuggling, and drug trafficking, are on the rise. These accounts are called funnel accounts (also known as interstate funnel accounts), a method used to launder money that exploits branch networks of financial institutions*.*
• Money Laundering - Concealing the source, movement, or usage of funds that are derived from illicit sources in an effort to make them appear legitimate.
• Money Mule - A money mule is someone who transfers or moves illegally acquired money on behalf of someone else.
• OFAC Screening - Office of Foreign Assets Control screening to monitor if payee or payor has been flagged by the US government as a sanctioned individual.
• Placement - First stage of the money-laundering process. A process of introducing unlawful proceeds into the financial system.
• Smurfing - A money laundering technique by using multiple transactions or individuals to conceal the movement of funds that would exceed reporting thresholds.
• Transaction Monitoring - A process to monitor entity’s behavior, primarily used to monitor money transfers. The goal of the process is to identify any suspicious behavior that could indicate entity’s involve with financial crime.
• Account Decisioning - The ability to take action on an end-user account status upon case review (e.g. freeze account, close account, unlock account, etc.).
• Device Monitoring - Running evaluations using device metrics such as IP, device type, device ID, etc. This data is collected at the time of login or transaction via the front-end SDK.
• Investigation - A process of performing due diligence in response to an alert raised for a customer by obtaining, evaluating, and storing any information, docs, or other research; this may also lead to escalation for enhanced due diligence (EDD).
• Structuring - A distribution of funds into smaller amounts to bypass reporting requirements (smurfing is a method to structure funds). This strategy is often used to disburse or funnel cash out of or into financial system.
• API Processing - An implementation method in which transactions are sent to Alloy in real-time as they occur by the client.
• Batch Processing - An implementation method in which a day or days worth of transactions are gathered in a single file to send to an SFTP shared between Alloy and the client, along with the customer and account files. These transactions are transformed via the ETL process built by Alloy’s Data Engineer, often process a day after the transaction date.
• Transaction Interdiction - Ability to stop payment before it goes through. Typically done with API Processing and accompanied by Alloy’s Transfer Request solution.
• Collusive Counterparty - Suspicious interaction between the entity and counter-party. Typically detected by the Counter-party MLA, where majority of entity funds are directed to/from a single counter-party.