Key concepts

FlowSentry uses a small set of ideas consistently across every screen. Learn these and the rest of the product falls into place. For a longer A–Z list, see the Glossary.

Monitoring

Rule and scenario

A rule describes a pattern worth investigating, such as "three or more cash deposits just below the reporting threshold within 24 hours". A scenario is a ready-made rule from FlowSentry's built-in pack, covering common typologies such as structuring, mule accounts, rapid pass-through, velocity and wires to high-risk jurisdictions. Your institution can run the built-ins as shipped, tune them, switch them off, or write its own rules.

Every rule has thresholds — named parameters such as a minimum amount or a count — that your institution can set without changing the rule's logic, and a window such as "over 24 hours, per customer". Each change creates a new rule version, and only an approved, active version runs.

Typology

A typology is a known method of laundering money or financing terrorism, such as structuring (smurfing), use of money mules, layering or trade-based laundering. Rules are tagged with the typology they detect, so dashboards can show which risks are firing.

Alert

An alert is raised when a transaction, or a group of transactions, matches an active rule. It records which rule and version fired, the thresholds against the actual values, the window and the transactions that triggered it. Each alert has a severity (Low, Medium, High, Critical), a priority score and an SLA — the time your institution allows to work it. After an alert, a cool-off stops the same pattern on the same subject raising duplicate alerts.

Backtest

A backtest replays stored transactions through a rule exactly as the live engine would, to show how many alerts it would have raised and an estimate of false positives based on past decisions. Run one before submitting a rule change.

Investigation

Case

A case groups one or more alerts about a subject for investigation. Cases move forward through four stages: Triage, Investigation, Review and Closed. A case holds the alerts, transactions, related parties, screening results, documents, notes, information requests and a full history.

Disposition and reason code

Closing an alert is a disposition: an outcome ("No suspicion (activity explained)" or "Inconclusive"), a reason code from your institution's catalogue and a written rationale. A sample of closures goes to QA review.

Suspicion, STR, SAR and the suspicion clock

When an investigator believes activity may be linked to money laundering or terrorist financing, they record suspicion on the case with their grounds. This starts the suspicion clock — the number of business days your institution allows before the MLRO must decide. The MLRO then decides whether to file a Suspicious Transaction Report (STR) or a Suspicious Activity Report (SAR) with the FIU, return the case for more work, or record a reasoned decision not to file in the internal no-file register.

CTR

A Cash Transaction Report (CTR) reports cash transactions above the regulatory threshold. FlowSentry batches qualifying cash activity daily into draft CTRs for review and release.

goAML and the FRC

goAML is the reporting platform and XML format used by many financial intelligence units (FIUs), including Kenya's Financial Reporting Centre (FRC). FlowSentry builds and validates goAML reports from your data and tracks their hand-off to the FIU portal.

Tipping-off

Tipping-off means letting a customer know, directly or indirectly, that they are under suspicion or have been reported. It is an offence. FlowSentry restricts STR material to STR-privileged roles, keeps relationship managers and executives out of cases, and reminds investigators to ask only for facts in information requests.

Screening

Screening hit

A screening hit is a possible match between one of your customers (or a director or beneficial owner) and an entry on a sanctions, PEP or internal list. Each hit is reviewed and decided: cleared as a false positive, proposed as a true match for a second person to confirm, or escalated to a case. A cleared hit is remembered and does not come back unless the customer's details or the list entry change.

Statutory list and TFS

Statutory lists — the UN Security Council consolidated list and Kenya's domestic designations — carry legal obligations under targeted financial sanctions (TFS). They are always screened, hits on them come first in the queue, and decisions on them always need two people.

PEP and RCA

A politically exposed person (PEP) holds, or has held, a prominent public function. Relatives and close associates (RCAs) are linked to a PEP. Both call for enhanced due diligence.

Exclusion

An exclusion (a "good-guy" exclusion) records that a known customer is not a particular listed person, so screening stops alerting on that pair. It is stronger than a clear, so it needs a second person's approval and expires.

Customers and risk

KYC status

Each customer has a KYC status: Complete, Incomplete (a required item is missing), ID expired or Review due. Changes to a live customer's KYC details are proposed and only apply once someone else approves them.

Risk band

Every customer has a risk rating: a 0–100 score built from five factor groups — customer, geography, product, channel and behaviour — mapped to a risk band: Low, Medium, High or Very high. Floor rules can raise the band (for example, a domestic PEP is never rated below Medium). An approved override can change the effective band for a limited period. A High band opens an EDD (enhanced due diligence) case automatically.

Controls

Maker-checker (four eyes)

Maker-checker means one person proposes (the maker) and a different person approves (the checker). FlowSentry enforces it on the server for every regulated outcome — rule activation, STR decisions, true matches, list and exclusion changes, KYC changes, onboarding approvals, risk overrides, settings and data-source go-live. You can hold both permissions, but you can never check your own item. This is also called segregation of duties.

Step-up

Step-up asks for a fresh second factor (an authenticator code or a passkey) immediately before a sensitive action, and is valid for five minutes. See Sign in, set up MFA and understand step-up.

Audit trail

Every governed action is written to an append-only, hash-chained audit trail that names the real person, what changed and when. Any tampering breaks the chain and shows on the Audit trail page.

AI draft

Output from an AI assistant is always labelled AI draft — advisory (or Generated without AI when a rules-based draft is shown instead). Drafts never act: a person reads, edits and decides.

Related

• Glossary
• Status and badge meanings
• Compliance and governance guide