Plumbline - AML Transaction Monitoring with Alerts, Cases and SAR Deadlines in One System
AML Monitoring Platform for a US Neobank
Designed and built a clickable AML transaction monitoring system for a US neobank and its sponsor bank: scenario alerts ranked by a transparent priority score, an investigation workspace that shows why each alert fired, real-time payment holds, and cases that count down to the SAR filing deadline.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Impact
Dashboard, alert queue, alert investigation, cases and case detail. Every demo alert and case opens its own workspace, with close, escalate, hold and decision modals.
Rapid movement of funds, two structuring rules, high-risk geographies, dormancy, P2P velocity, mule fan-in, shared devices, profile mismatch and funnel accounts, each shown with the values that crossed its threshold.
Counted from the detection date, or 60 days when no suspect is identified, and red within 5 days. Alerts carry their own SLA clock of 2, 5, 10 or 15 business days by priority band.
24 alerts across all 10 scenarios, 13 cases from alerts and referrals, 18 members including 2 businesses, and 9 staff users from L1 analyst to BSA/AML officer.
The Problem
Halyard Money grew from 200,000 to 1.2 million members in two years while its monitoring stayed a set of morning SQL queries exported to spreadsheets and worked in a shared inbox. Alerts sat for weeks, 97% were closed as false positives, nobody could show why a threshold was set where it was, and SAR narratives were written from scratch and emailed to the bank. The sponsor bank's oversight review found a backlog of more than 4,000 alerts and asked for a remediation plan.
Our Solution
Plumbline is that plan: one system where every alert has an owner and a clock. Scenarios raise alerts in real time and in nightly batches, analysts work them in priority order with the reason each one fired, investigators group them into cases and build the transaction story, and every case counts down to its SAR deadline under a confidentiality banner.
The Challenge: Monitoring for a Bank Without Being One
Halyard does not hold a bank charter. Its accounts and cards are issued by Prairie Ridge National Bank, an OCC-supervised sponsor bank, under an agreement that makes Halyard run day-to-day monitoring while the bank keeps ultimate responsibility for its Bank Secrecy Act program.
Deadlines Set by Regulation
A SAR is generally due within 30 calendar days of initial detection, or up to 60 when no suspect has been identified. Cash over USD 10,000 in one business day goes on a CTR within 15 days. With alerts sitting for weeks, those clocks were running before anyone looked.
Thresholds Nobody Could Defend
Supervisors expect monitoring scenarios to be governed like models, with documented design, tuning evidence and independent validation. Halyard's thresholds had no recorded rationale, and 97% of alerts led nowhere.
SAR Data That Must Not Leak
Under 31 U.S.C. 5318(g)(2), nobody involved may learn that a SAR was considered or filed. SAR data has to stay with named roles, and anything sent to member support, such as a request for information, has to use neutral wording.
Many Rails, One Customer Picture
Card, ACH, RTP, FedNow, in-app P2P and retail cash loads all arrive on different rails, some in real time. An analyst has to read them together against what the member declared at onboarding to tell a mule account from a busy hair stylist.
Our Approach: From BSA Rules to a Clickable Monitoring System
Spec and Rules Research
Mapped 10 roles across Halyard, the sponsor bank, validators and internal audit, 32 screens including a sponsor bank portal, and the data model for members, transactions, versioned scenarios, alerts, cases, SARs, CTRs, tuning tests, change requests and validation packs. Wrote down the rules the design follows: the BSA and FinCEN regulations, SAR and CTR timing, SAR confidentiality, structuring, the CDD rule, the 2023 third-party guidance and the April 2026 model risk guidance.
Clickable Demo on a Production UI Kit
Built 5 key screens on a production dashboard kit: the dashboard with KPIs, backlog by age and priority band, alert volume by scenario family and scenario effectiveness, the alert queue with Pick next and hold countdowns, the alert investigation with transactions, profile vs actual, counterparties, prior alerts and notes, the case list with SAR deadlines, and the case detail with subjects, checklist, transaction tagging and decision. All actions run on local state.
What a Production Build Adds
Real-time transaction streaming through Kafka, the ledger, card processor, payment rails and retail cash network, CDD profiles from onboarding, sanctions hits from screening, device intelligence and a warehouse for batch scenarios. Then the SAR editor with its narrative assistant, CTRs, scenario tuning with above- and below-the-line testing, change control, validation packs, QA sampling, the sponsor bank portal, role-based SAR clearance and a tamper-evident audit log.
Why It Works: Every Alert Has an Owner and a Clock
Alerts Explain Why They Fired
Each alert states its rule in plain language with the values that crossed it, such as inbound USD 18,400 from 11 senders in 72 hours with 94% sent out against an 80% threshold, so an analyst starts from the evidence instead of a score.
A Priority Score You Can Read
The 0 to 100 score is broken into scenario weight, customer risk rating, amount band, prior SARs, network links and account age, with bands at 80, 60 and 40. Pick next hands the analyst the highest-priority unassigned alert.
Holds and Deadlines Stay Visible
A real-time hold on an outbound payment shows its countdown in the queue and as a banner on the alert, with a release or keep decision. Cases sort by SAR deadline, and closing an alert needs a reason code and a written rationale.
Confidential by Design
Once a case has a SAR decision it carries a confidential banner citing 31 U.S.C. 5318(g)(2). Requests to member support go out as neutral tasks, and recommended account actions are carried out by operations with neutral wording to the member.
Related case studies
View all: RegTech & compliance
Gija - KYC and KYB Case Management with Ownership Tracing and Four-Eyes Approval
Designed and built a clickable KYC and KYB case-management platform for a Vilnius electronic money institution: a case queue with SLAs, individual and business cases with registry comparison and beneficial ownership traced through every layer, an explainable risk score, four-eyes approval and requests for information sent to customers.
Plimsoll - Regulatory Reporting Platform for APRA and AUSTRAC Returns
Designed and built a clickable regulatory reporting platform for an Australian customer-owned bank: prepare APRA returns from core banking and general ledger data, clear validation errors, comment on variances, approve adjustments within policy limits and sign off against an evidence pack, with every reported number traceable to its source.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab