Switch a built-in scenario off or back on

FlowSentry ships with a pack of about 25 built-in scenarios covering common typologies, such as structuring, mule fan-in, rapid movement of funds, velocity, wires to high-risk jurisdictions and round amounts. They run alongside your institution's own rules. If a built-in does not fit your business, you can switch it off for your institution, or tune it instead. Neither takes effect until a second person approves.

Before you start

• To request a switch off or switch back on, you need a role that can author rules: Analyst, Senior analyst, MLRO or Deputy MLRO.
• To approve the request, you need the MLRO, Deputy MLRO or Administrator role, and a second factor for step-up. You can never approve your own request.
• Switching a built-in off affects only your institution. Other institutions are not affected.

Tip: Before you switch a scenario off, look at its performance on the rule page (alerts in the last 30 and 90 days, and false positives) and run Backtest this version. Often tuning a threshold is better than losing the coverage altogether.

Switch a built-in off

1. Open Rule library in the Monitoring module, or go to /monitoring/rules.
2. Find the scenario. Search by id or name, or filter by Typology.
3. Open the rule page.
4. Select Switch off.
5. In the dialog, enter a Reason. Explain why the scenario is not needed, for example that your institution does not offer the product it monitors. The approver and the audit trail will see it.
6. Select Request.

The request is sent to a second person and appears in their My approvals inbox. The scenario keeps running until the request is approved.

Approve or reject the request

1. Open the item from My approvals at /approvals/inbox, or from the rule page.
2. Read the reason and check the rule's performance and coverage.
3. Choose one:
   • Approve, noting What you checked. You will be asked to confirm with a fresh second factor if you have not done so in the last five minutes. The built-in then stops running for your institution.
   • Reject, explaining Why it cannot go live. The person who asked sees your reason on the rule page.

While the request waits, the rule page says "Waiting for a second person. You cannot approve your own change."

Find scenarios that are switched off

On the Rule library, the Built-ins switched off tile shows how many built-ins are off for your institution. A switched-off built-in shows the status Disabled.

Switch a built-in back on

1. Open the disabled scenario's rule page.
2. Select Switch back on.
3. Enter a Reason and select Request.
4. A different person approves it, with step-up, exactly as above.

Once approved, the built-in runs again as shipped.

Tune a built-in instead

If the scenario is useful but too noisy or too quiet, tune it rather than switching it off:

1. On the rule page, select Tune.
2. Change the thresholds or scope. Every threshold is a named parameter.
3. Run a backtest to see the projected alerts and estimated false positives.
4. Select Submit for approval. A different person approves with step-up.

Your tuned version keeps the scenario's id and replaces the built-in for your institution only.

Undo a tuned version

To go back to the built-in as shipped, Retire your tuned version. Retiring needs a reason and a fresh second factor. Once your version is retired, the built-in runs again.

Note: Every request, approval, rejection and retirement is recorded in the audit trail under the names of the people involved. Examiners can see exactly when a scenario stopped or started and why.

Related

• Build a monitoring rule
• Rules without code
• MLRO and Deputy MLRO