Security and access

FlowSentry protects sensitive compliance work with multi-factor authentication, fresh second-factor checks for high-impact actions, strict segregation of duties and a tamper-evident audit trail. This page answers the questions users ask most about these controls.

Signing in

How do I sign in?

Go to the sign-in page, enter your Work email and Password, and select Sign in. If you have a second factor set up, you are then asked to confirm it's you with a six-digit Verification code from your authenticator app, or with a passkey. Every sign-in is recorded in the audit trail.

Do I have to set up MFA?

By default, multi-factor authentication is mandatory for the MLRO, Deputy MLRO and Administrator roles, and your institution can extend it to other roles. If your role requires it, you are taken to Security & MFA with the message "Your role requires MFA — Complete enrolment to continue using FlowSentry." Anyone can enrol from the user menu, and anyone who performs step-up actions needs a second factor.

How do I set up an authenticator app?

1. Open the user menu by selecting your name and choose Security & MFA.
2. Scan the code with Microsoft Authenticator, Google Authenticator or any TOTP app. If you cannot scan, choose Or enter the key and type it into the app.
3. Enter the six-digit code the app shows now and select Verify.

You will see "Your authenticator app is set up". You can then add a passkey too.

What is a passkey?

A passkey lets you confirm it's you with Touch ID, Windows Hello or a security key instead of typing a code. Open Passkeys from the user menu, give the device a Device label (for example, the phone or key name), select Add a passkey and confirm with the device when your browser asks. Passkeys work at sign-in and for step-up.

I lost my phone. What do I do?

Ask your administrator to reset your second-factor enrolment. Once it is reset, sign in and enrol again on your new device. If you had also registered a passkey on another device, you can use that in the meantime.

Warning: Never share your authenticator codes, authenticator key or password with anyone, including colleagues or anyone claiming to be from FlowSentry.

Why is my account locked?

Repeated failed sign-ins lock an account temporarily, and sign-in attempts are rate-limited. Wait and try again, or contact your administrator. If you did not make those attempts, tell your administrator straight away.

Can we use our own single sign-on?

Single sign-on with providers such as Microsoft Entra ID, Okta and Google is available for enterprise deployments. Speak to the FlowSentry team about your requirements.

Step-up checks

What is step-up?

Some actions have regulatory consequences, so FlowSentry asks you to confirm it's you again with a fresh second factor just before you act. Step-up is needed for actions such as:

• the STR filing decision
• confirming a screening true match, or approving a proposed clear or a PEP decision
• activating a watchlist version or approving an exclusion
• activating a rule or a risk model, and approving a risk override
• approving a KYC change or a high-risk onboarding
• approving tenant settings and turning kill switches on or off
• approving a data source go-live, and rotating or revoking its key

How long does a step-up last?

Your confirmation must be at most five minutes old. Within that window you can complete several sensitive actions without being asked again. After five minutes, you will see "This action needs a fresh second factor." Select Verify now (step-up), enter your Authentication code and select Confirm. You are returned to the same item.

My code was rejected. Why?

Codes change every 30 seconds, so enter the code currently showing in your app. If codes keep failing, check that the date and time on your phone are set automatically. See Troubleshooting.

Segregation of duties

Why can't I approve my own item?

FlowSentry enforces maker-checker: one person never plays both parts on the same item. If you proposed, authored, recorded or captured something, a different authorised person must approve it. If you try, you will see "The approver must be a different person from the author (segregation of duties)." This is checked on the server, not just hidden in the screen.

Which actions use maker-checker?

Among others: suspicion and the MLRO's filing decision, alert closure and QA review, a proposed true match and its confirmation, watchlist versions, rule versions, onboarding approvals, tenant settings and policies, data source go-live, mapping templates, KYC changes on live customers, exclusions, PEP declassification, risk overrides and risk model activation.

What if the MLRO recorded the suspicion?

Then the MLRO cannot decide it. Another decider, normally the Deputy MLRO, must decide it.

Confidentiality and the audit trail

What is tipping-off, and how does FlowSentry prevent it?

Tipping-off means letting a customer know, directly or indirectly, that they are under suspicion or have been reported. FlowSentry limits STR material to STR-privileged roles. Relationship managers and executives never see alerts or cases, and a relationship manager answering an information request sees only the question and the answer box. Exports are watermarked and recorded.

What does the audit trail record?

Every action is attributed to a named person. The audit trail is append-only and hash-chained per module, which makes tampering evident. Auditors and administrators can open Audit trail, where Chain integrity is re-verified each time the page opens.

Are revealed identifiers recorded?

Yes. Identifiers are masked in registers and exports. Selecting Reveal is recorded in the audit trail.

Why can't I see a page?

Access is role-based and default-deny. A page you cannot open does not appear in the rail, flyouts or command palette. Ask your administrator if you think you need it.

Related

• Sign in and MFA
• Roles overview
• Security and privacy overview
• Troubleshooting and error messages
• Compliance and governance guide