How a financial crime desk stops briefing regulators with screenshots
A major financial institution assembles AML escalation packs across siloed systems; KnowledgeHub sits above them as a semantic layer with citation-first retrieval and human-approved drafts.
Every assertion carries its source.
What fails is the assembly
The evidence exists. Finding it and proving it, is the problem.
An AML escalation desk at a major Nordic financial institution has a process that works until it doesn't. Tier 2 reviewers are skilled. The alert logic is sound. The risk typologies are well understood.
What fails is the assembly.
Each alert pack requires a reviewer to open four or five separate systems: a transaction monitoring platform, a CRM, a case management tool, a sanctions watchlist, and a shared drive of prior investigation PDFs. The relevant passages are there. Pulling them into a coherent, cited narrative, one that a supervisor can sign off and a regulator can scrutinise, takes hours of manual work per alert.
The deeper problem is provenance. When an analyst cites a source, there is no systematic record of which version of a policy or typology library governed the decision. A review conducted under one ontology release is indistinguishable, on paper, from one conducted under a later revision. Supervisors approve decisions they cannot fully trace.
The question is not how to automate the work. It is how to make the work defensible.
KnowledgeHub is deployed as a semantic layer above the institution's existing systems. Nothing is replaced. The transaction monitoring platform, the CRM, and the document repositories remain in place. What changes is the substrate connecting them.
Each approved corpus, watchlist data, prior case files, policy documents, CRM excerpts, is ingested with lineage preserved at the passage level. A versioned ontology defines the semantic relationships between entities, risk indicators, and regulatory concepts. When the ontology is updated because a typology changes, or a regulatory guidance note is revised, that change is logged, timestamped, and traceable.
Agents are given specific, bounded tasks: retrieve the relevant passages for a flagged entity, surface prior case connections, draft the narrative section of the alert pack. Analysts review and approve every draft before it moves. The agents do not make decisions. They assemble evidence and show their work.
Lineage on every passage
Each assertion is tied to its corpus fragment, ontology release and timestamp.
Drafts, approved by analysts
Bounded agents assemble cited drafts. Analysts approve before anything crosses the perimeter.
Graphs instead of screenshots
Escalations are rehearsed with reproducible retrieval graphs instead of screenshot-led decks.
From alert to pack, with the trail intact
The alert is escalated
A tier 2 alert lands on the desk. The retrieval starts before the analyst opens it.
KnowledgeHub traverses the knowledge graph: entity relationships, transaction patterns, prior SAR filings, sanctions exposure and CRM notes.
The evidence, ranked and attributed
The result is a ranked set of cited passages.
Each passage is tagged with its source document, ingestion timestamp and the ontology version that classified it.
Evaluate, correct, approve
The analyst's job is not to find the evidence. It is already surfaced.
The analyst evaluates it, corrects it where needed and signs off. Nothing leaves the desk without that approval.
Same query, same result
The pack that leaves the desk carries every citation intact.
The supervisor sees the data trail behind the narrative, and compliance can reproduce the retrieval graph months later with the same ontology version.
Provenance, not recollection
Estimated reduction in manual citation assembly time.
- Supervisors review packs rather than reconstruct them.
- Cross-team handoffs carry a cited narrative instead of a note saying "see attachments".
- Compliance has a reproducible record of every retrieval, tied to an ontology release.
- An examiner's question is answered with a citation chain.
- Sector
- Financial sector
- Region
- Denmark / Nordics
- Org scale
- 1k–15k relevant seats
- Personas
- Tier 2 AML reviewers, supervisors, financial crime compliance, IT security
- Products
- KnowledgeHub · Case workspace · Graph traversal · Agents
- Compliance
- GDPR-aligned processing · ISO 27001 posture · configurable retention
Operational outcomes
per quarter
days
files
More from Financial institutions
Easy to start. Safe to stop.
The pilot runs at a fixed price: we map the workflow, deploy it in your environment and prove it on your own cases. Then you decide.
Fixed price · Fixed timeframe
- 01
Map the workflow
Two weeks with your people where we document what happens today, including the parts nobody wrote down.
- 02
Deploy in your environment
Inside your tenancy, on your data residency terms, with no exports and nothing leaving through the side door.
- 03
Prove it under audit
Controlled evaluation against your own cases with compliance and the process owner signing off before go-live.
- 04
Run in production
We stay on with retraining, reporting and ongoing oversight for as long as the workflow runs.
Fixed price, Fixed timeframe. 8–12 weeks pilot: Continue (Expand once you know it works) / Stop.