L1 alert review
Under your disposition rules, we triage monitoring alerts and record a false-positive rationale for each alert they let us close.
Firefly FinancialCrimeOS · Financial Crime Operations
We prepare the investigation. Your MLRO decides what to file.
We triage alerts, gather the evidence, follow your procedures, and write up each case for your compliance team.
Unit of work · An accepted investigationScroll to explore
The problem
Judgment waits behind routine alerts.
Your analysts rebuild the same customer history for every alert, while the cases that need judgment wait behind the rest.
Who it servesHeads of financial crime, AML, and compliance operations, and investigation teams
What the service includes
We do the work within the limits of your policy.
Your service schedule lists the tasks your operation includes.
L2 investigation
We gather the evidence you permit and separate facts, inconsistencies, and open questions, each linked to its source.
Name-screening hits
Sanctions, politically exposed person (PEP), and adverse-media hits go to their own queue, where we prepare each disposition for your reviewer.
Requests for information
We draft requests for information from your templates, send them under your tipping-off rules, and chase each answer.
Narratives and SAR or STR drafts
We write each case narrative and draft the suspicious activity or transaction report (SAR or STR); filing stays with you.
Look-backs and quality sampling
We run look-backs and remediation programs in batches, and sample completed investigations against your quality standard.
How the service works
Five stages, and who does each one.
Each stage runs on the method that fits the cost of an error.
- 01
Assign
Approved rules
We check scope and priority under your approved rules.
InputEligible alert or case
OutputA controlled investigation queue
- 02
Gather
AI model
We collect evidence from your approved sources and link each item to its source.
InputApproved sources
OutputA source-linked case record
- 03
Investigate
AI agent
Step by step, an AI agent works your procedure and records each finding with its source.
InputEvidence and procedure
OutputDocumented findings
- 04
Review
AI recommends
We prepare disposition recommendations or escalation packages, quality-checked before they reach you.
InputFindings and quality checks
OutputAn accepted investigation package
- 05
Conclude
Your team decides
Your MLRO or compliance team decides the disposition and any filing; we record the outcome.
InputAccepted investigation package
OutputYour disposition, documented
What you receive
The finished work and the evidence behind it.
Unit of workAn accepted investigation
- Completed investigation package with source-linked findings
- L1 alert dispositions with a false-positive rationale
- Name-screening hit dispositions prepared for review
- SAR or STR drafts, when in scope
Systems and technology
We work in your systems, on open-source modules.
Connected to your systems
Monitoring and case-management systems, customer and transaction data, screening tools, external data, and secure document stores.
Built on Firefly OpenPlatform
Your teams can read the code of each module.
Measures
We measure the work you receive.
- Completion time by case tier
- First-pass quality acceptance
- Rework and material finding omissions
- Escalation age and backlog movement
Scope, pricing, and growth
Start small and expand on evidence.
A focused starting point
A bounded L1 alert-review or evidence-gathering queue with stable procedures.
How the service is priced
Per accepted investigation, by case tier, with a recurring commitment and agreed quality standards.
Where the service can grow
Add case types once the first queue meets your standard, or add OnboardingOS.
Questions
What buyers ask before they scope.
Can the AI learn from every customer’s investigations?
No. Your data never trains models used for other clients. Data use, retention, and any model improvement rights are set in your contract.
Are name-screening hits handled like monitoring alerts?
No. A hit asks whether a name matches a person on a list, while an alert asks whether activity is unusual.
How are errors corrected?
We log each defect with its cause and fix it; material issues go to the accountable owner on your side.
Your first operation
Bring us one operation.
Tell us the process, the volume, and what “done” looks like. We will come back with a scope, a deployment plan, and a proposal.