Source: [Financial Crime Operations](https://fireflysoftware.io/services/financialcrimeos/)

Description: FinancialCrimeOS: Firefly triages alerts, investigates cases, and drafts the SAR or STR where a case needs one. Your MLRO or BSA officer decides what to file.

Language: en

Firefly FinancialCrimeOS · Financial Crime Operations

# We prepare the investigation. Your MLRO decides what to file.

We triage alerts, gather the evidence, follow your procedures, and write up each case for your compliance team.

[Scope your investigation operation](https://fireflysoftware.io/contact/) [Request a demo](https://fireflysoftware.io/contact/?request=demo)

FinancialCrimeOS · Financial Crime Operations, as a line of five stages. Assign: deterministic code applies your approved rules. Gather: an AI model reads, classifies, extracts or drafts. Investigate: an AI agent works the case within the limits you approve. Review: our AI prepares a recommendation for your team to decide. Conclude: your team decides.

Unit of work · An accepted investigation  [Scroll to explore](https://fireflysoftware.io/services/financialcrimeos/#operation)

The problem

## Judgment waits behind routine alerts.

Your analysts rebuild the same customer history for every alert, while the cases that need judgment wait behind the rest.

Who it serves Heads of financial crime, AML, and compliance operations, and investigation teams

What the service includes

## We do the work within the limits of your policy.

Your service schedule lists the tasks your operation includes.

01

### L1 alert review

Under your disposition rules, we triage monitoring alerts and record a false-positive rationale for each alert they let us close.

02

### L2 investigation

We gather the evidence you permit and separate facts, inconsistencies, and open questions, each linked to its source.

03

### Name-screening hits

Sanctions, politically exposed person (PEP), and adverse-media hits go to their own queue, where we prepare each disposition for your reviewer.

04

### Requests for information

We draft requests for information from your templates, send them under your tipping-off rules, and chase each answer.

05

### Narratives and SAR or STR drafts

We write each case narrative and draft the suspicious activity or transaction report (SAR or STR); filing stays with you.

06

### Look-backs and quality sampling

We run look-backs and remediation programs in batches, and sample completed investigations against your quality standard.

How the service works

## Five stages, and who does each one.

Each stage runs on the method that fits the cost of an error.

1. 01
   ### Assign
   Approved rules
   We check scope and priority under your approved rules.
   Input Eligible alert or case
   Output A controlled investigation queue
2. 02
   ### Gather
   AI model
   We collect evidence from your approved sources and link each item to its source.
   Input Approved sources
   Output A source-linked case record
3. 03
   ### Investigate
   AI agent
   Step by step, an AI agent works your procedure and records each finding with its source.
   Input Evidence and procedure
   Output Documented findings
4. 04
   ### Review
   AI recommends
   We prepare disposition recommendations or escalation packages, quality-checked before they reach you.
   Input Findings and quality checks
   Output An accepted investigation package
5. 05
   ### Conclude
   Your team decides
   Your MLRO or compliance team decides the disposition and any filing; we record the outcome.
   Input Accepted investigation package
   Output Your disposition, documented

What you receive

## The finished work and the evidence behind it.

Unit of work **An accepted investigation**

- Completed investigation package with source-linked findings
- L1 alert dispositions with a false-positive rationale
- Name-screening hit dispositions prepared for review
- SAR or STR drafts, when in scope

Authority

## The decisions stay with your institution.

### You decide

- AML policy
- Alert-closure rules
- Name-screening hit disposition
- Suspicious-activity decisions
- Filing authority

### We do

- Alert triage
- Evidence gathering
- Case narratives
- SAR or STR drafts
- Quality review

Systems and technology

## We work in your systems, on open-source modules.

### Connected to your systems

Monitoring and case-management systems, customer and transaction data, screening tools, external data, and secure document stores.

### Built on Firefly OpenPlatform

Your teams can read the code of each module.

- [Customers and relationships](https://fireflysoftware.io/openplatform/modules/#customers)
- [Onboarding and verification](https://fireflysoftware.io/openplatform/modules/#onboarding)
- [Accounts and financial records](https://fireflysoftware.io/openplatform/modules/#accounts)
- [Payments and cards](https://fireflysoftware.io/openplatform/modules/#payments)
- [Risk and compliance operations](https://fireflysoftware.io/openplatform/modules/#risk)

Measures

## We measure the work you receive.

- Completion time by case tier
- First-pass quality acceptance
- Rework and material finding omissions
- Escalation age and backlog movement

Scope, pricing, and growth

## Start small and expand on evidence.

01

### A focused starting point

A bounded L1 alert-review or evidence-gathering queue with stable procedures.

02

### How the service is priced

Per accepted investigation, by case tier, with a recurring commitment and agreed quality standards.

03

### Where the service can grow

Add case types once the first queue meets your standard, or add OnboardingOS.

Operating model

## All ten services run the same way.

[See how we operate](https://fireflysoftware.io/how-we-operate/) [See service levels and control](https://fireflysoftware.io/service-levels-and-control/)

Questions

## What buyers ask before they scope.

Can the AI learn from every customer’s investigations?

No. Your data never trains models used for other clients. Data use, retention, and any model improvement rights are set in your contract.

Are name-screening hits handled like monitoring alerts?

No. A hit asks whether a name matches a person on a list, while an alert asks whether activity is unusual.

How are errors corrected?

We log each defect with its cause and fix it; material issues go to the accountable owner on your side.

Your first operation

## Bring us one operation.

Tell us the process, the volume, and what “done” looks like. We will come back with a scope, a deployment plan, and a proposal.

[Scope your investigation operation](https://fireflysoftware.io/contact/) [Request a demo](https://fireflysoftware.io/contact/?request=demo)
