Fraud and AML Console
Fraud and Risk Engine (FRE) cases, blocklists and AML screening - decisions fail closed
Emmanuel Bizimana - Fraud Analyst
6 high-tier - 1h MLRO SLA
Open cases
37
+5 today
High tier (1h SLA)
6
2 breaching
Sanctions / PEP hits today
4
1 confirmed
Blocklist entries
1,982
parties, devices, MSISDNs
Cases (oldest SLA first)
| Case | Party | Typology | Score | Tier / SLA | Decision |
|---|---|---|---|---|---|
| FRAUD-8842 | W-4471 | SIM-swap | 842 | High 00:08 | HOLD |
| FRAUD-8839 | W-9902 | Structuring | 671 | Med 02:41 | STEP-UP |
| FRAUD-8835 | Muhazi Auto Parts | Wash trading | 603 | Med 03:55 | HOLD |
| FRAUD-8830 | W-3390 | Mule (fan-in) | 548 | Low 41:12 | Review |
| FRAUD-8824 | Agent SB-4471 | Float manipulation | 512 | Low 44:30 | Review |
Three-tier AML SLA: Low - review within 48h; Medium - hold and clear within 4h; High - block and escalate to the MLRO within 1h.
FRAUD-8842
High tier - 00:08 to MLROWallet W-4471 - Jean Bosco Niyonzima - opened 18 min ago by FRE
842
risk score / 1000
Decision HOLD - funds reserved, not moved. Fails closed pending human review.
Reasons and contributions
SIM-swap signal in last 24h+310
New device plus credential reset+260
Rapid high-value cash-out attempt+192
Impossible-travel geo jump+80
Evidence: MTN SIM-swap feed, device fingerprint mismatch, session IP reputation. Full evidence chain in the case timeline.
Actions
Maker-checker: blocklist changes and SAR filing require a distinct approver (the MLRO approves the SAR). Every action lands in the hash-chained WORM audit.
Blocklist and watchlist
Add to list
Maker-checker: a blocklisted party is blocked immediately on approval; a watchlisted party keeps configured friction within policy.
Fail closed: a sanctions or PEP hit holds the transaction and opens a case rather than allowing it while a human catches up. High-tier confirmed hits escalate to the MLRO within 1 hour and drive a SAR to the Financial Intelligence Centre.
| Alert | Party | List / type | Match | Tier / SLA | Disposition | Action |
|---|---|---|---|---|---|---|
| AML-4471 | Jean Bosco Niyonzima | OFAC SDN | 98% name and DOB | High 00:08 | Awaiting MLRO | Review |
| AML-4468 | Grace Umutoni | PEP | Domestic PEP, medium | Med 02:10 | In review | Review |
| AML-4462 | Nyanza Dairy Store (UBO) | UN list | 62% near-match | Low 39:44 | Queued | Review |
| AML-4455 | Samuel Nsengimana | Local list | 54% near-match | Cleared | False positive | View |
Screening sources: OFAC, UN and local sanctions lists plus PEP status, supplied by the single AML vendor. Screening (method 6) is mandatory at every wallet tier above 0 and re-runs quarterly.
Fraud and AML Console
One High alert has 8 minutes left
ALT-2026-4471 has 8 minutes of its 1 hour window left. A High alert that breaches does not close itself and is not downgraded. It escalates to the MLRO and the breach is recorded against the team, because an alerting standard nobody measures is not a standard.
| Alert | Tier | Typology | Window left | Assignee |
|---|---|---|---|---|
| ALT-2026-4471 +250 788 000 114, 9 cash-outs in 40 minutes | High | Structuring, sub-threshold splitting | 8 minutes | Unassigned |
| ALT-2026-4468 Circular flow across 4 wallets | High | Circular transaction, graph detection | 34 minutes | m.habimana |
| ALT-2026-4455 Sanctions name similarity 91% | Medium | Sanctions screening, fuzzy match | 5h 12m | j.mukama |
| High tier window | 1 hour to first action |
| Medium tier window | 6 hours |
| Low tier window | 24 hours |
| On breach | Escalates to the MLRO, recorded, never auto-closed |
| What counts as first action | Assigning it is not enough. A decision or a documented step is. |
Fraud and AML Console
Who has what, and what nobody has
An unassigned case is nobody responsibility, so the console shows that plainly. Cases carry an assignee chip and can be reassigned, and the queue is deliberately not auto-distributed: an analyst picking a case up is a decision worth recording.
| Case | Assignee | Age | Last action | State |
|---|---|---|---|---|
| FRD-2026-2218 Disputed cash-out, RWF 40,000 | j.mukama | 2h 14m | Customer called, wallet frozen | In progress |
| FRD-2026-2214 Customer reported a lost phone | j.mukama | 4h 02m | Freeze confirmed by a checker | In progress |
| FRD-2026-2211 Merchant wash trading suspicion | Nobody | 1d 6h | Opened automatically by the engine | Unassigned |
| FRD-2026-2209 Agent float variance, 3 agents | Nobody | 1d 9h | Linked to INC-2026-0447 | Unassigned |
Fraud and AML Console
Your freeze is with a checker
The wallet is not frozen yet. Freezing somebody money is a serious step, so it needs a second operator even when the analyst is sure. What is in force right now is the lighter measure: a step-up on their next sensitive action.
| Request | ACT-REQ-2026-1180, protective freeze |
| Party | +250 788 000 114 |
| Case | FRD-2026-2211 |
| Maker | j.mukama, today 15:44 |
| Reason | Structuring pattern, 9 sub-threshold cash-outs in 40 minutes |
| In force meanwhile | Step-up required on the next sensitive action |
| Waiting on | Any risk checker, 3 available |
| If refused | The step-up requirement stays, the freeze does not happen |
| Measure | Needs a checker | In force now | Why |
|---|---|---|---|
| Require step-up | No | Yes | Lightest measure, reversible, no money is held |
| Freeze the wallet | Yes | Pending | Stops the holder using their own money |
| Hold a specific transaction | Yes | Not requested | Holds value in flight |
| Suspend the account | Yes | Not requested | Stops everything, including incoming |
| Add to the blocklist | Yes | Not requested | Platform wide, affects every product |