Themis/Daily Briefing
Runtime · 2.4M txn/24h
1 review pending
Daily Briefing · Saturday, May 16, 2026
Good morning, Yatin.
44 new alerts generated overnight across 5 production typologies. One material event: a new FinCEN advisory on pig butchering schemes (FIN-2026-A002) detected at 14:22 yesterday, with a draft typology (TYP-PIG-001) now awaiting your review. Calibration drift detected on TYP-HTR-001 (FP rate trending up 0.4 pp WoW). Two SHADOW typology comparisons show favorable performance vs Actimize.
Today's Headline
A new FinCEN advisory is awaiting your review.
TYP-PIG-001 (Pig Butchering) drafted from FIN-2026-A002 · 3 binding decisions pending your approval
Flagged today
44
+18% vs 7d avg
High severity
17
needs SAR review
Avg disposition time
42 min
▼ 14 min vs baseline
Pending actions
1
TYP-PIG-001 review
Today's Developments 5 items
Regulatory
New FinCEN advisory · FIN-2026-A002
Pig butchering investment fraud schemes. System parsed advisory and produced TYP-PIG-001 draft with 4 behavioral components. 2 of 8 concepts require Financial Crimes review (crypto exchange beneficiary, escalating amount regression).
Review draft →
📈
Calibration
TYP-HTR-001 · AG-08 proposes threshold change
Calibration Agent (AG-08) analyzed 7-day FP drift (0.012% → 0.016%) on TYP-HTR-001 and proposes raising the distinct-corridor-cities threshold from ≥3 to ≥4. Root cause identified: convention-season business travelers misfiring BC1. Projected impact: recall 92% → 90.8%, FP rate 0.016% → 0.0125%. Awaiting approval (impact exceeds auto-apply threshold).
Review proposal →
Discovery
ML Pattern Discovery · cluster ML-2026-Q1-44
Pattern Discovery Agent confidence improved 0.71 → 0.78 on trade invoice manipulation cluster. 14 additional supporting evidence points added. May be ready to draft typology spec.
View cluster →
📋
Internal Learning
23 new SARs ingested by AG-07
SAR Mining Agent processed 23 internal SARs in the past 24 hours. 21 mapped to existing typologies (95% match confidence). 2 flagged as pattern-novel and queued for clustering analysis.
View activity →
High-Priority Watchlist requires SAR review
ALT-2026-05-018481
Phoenix Trade Co · TYP-FNL-001
$186,251
HIGH
ALT-2026-05-018490
Liberty Wholesale Group · TYP-FNL-001
$154,883
HIGH
ALT-2026-05-018479
Eagle Mercantile · TYP-FNL-001
$153,777
HIGH
ALT-2026-05-018478
Apex Trading LLC · TYP-FNL-001
$142,800
HIGH
ALT-2026-05-018483
Pioneer Wholesale Co · TYP-FNL-001
$137,325
HIGH
External Sources Feeding Themis8 sources · AG-01 monitors all · click any row to expand
Source
Type
Access
Frequency
FATF
Financial Action Task Force
Global standards & reports
PUBLIC
Ongoing, multiple per year
Carries out ongoing research into evolving methods and trends to assist countries in identifying, assessing, and understanding their money laundering and terrorist financing risks. Their publications are the closest thing to a global typology canon.
How Themis uses this
TYP-FNL-001 derived from FATF FIN-2014-A005 framework on geographic funnel structuring.
FinCEN
Financial Crimes Enforcement Network (U.S. Treasury)
US advisories & trend reports
PUBLIC
As-needed advisories + periodic trend analyses
Through its Financial Institution Advisory Program, issues public and non-public advisories concerning money laundering or terrorist financing threats. Advisories typically include red flag indicators, typologies, and guidance on compliance.
How Themis uses this
TYP-CMLN-003 (shadow) derived from the August 2025 FinCEN CMLN advisory. TYP-HTR-001 derived from FIN-2020-A008. TYP-EFM-001 informed by 2024 Elder Financial Exploitation FTA.
Treasury NMLRA
U.S. Treasury National Money Laundering Risk Assessment
US national risk assessment
PUBLIC
Biennial (most recent: 2024)
Examines the current money laundering environment and identifies how criminals and other actors seek to launder funds. Provides a national-level threat landscape used by financial institutions to inform risk strategy.
How Themis uses this
Informs prioritization across typology categories (fraud, drug trafficking, cybercrime, human trafficking, professional money laundering).
Wolfsberg Group
The Wolfsberg Group (private-sector AML standard setter)
Industry principles & guidance
PUBLIC
Periodic updates
Provides a comprehensive framework covering customer due diligence, transaction monitoring, and reporting of suspicious activities. Their AML Principles serve as a benchmark for banks to measure effectiveness of AML programs.
How Themis uses this
Wolfsberg Factors (size, scale, footprint, customers, risk appetite) inform calibration constraint design and AG-08's tuning thresholds.
Egmont Group
Egmont Group of Financial Intelligence Units
Cross-border FIU intelligence
PARTIAL
Ongoing; periodic published case books
International network of FIUs sharing cross-border financial intelligence and case studies. The Best Egmont Cases series compiles instructive ML/TF analyses from member FIUs worldwide.
How Themis uses this
Case patterns inform AG-05 cluster signature templates. Cross-border layering schemes feed TYP-FNL-001 corridor expansion.
ACAMS / ACFE
Association of Certified Anti-Money Laundering Specialists / Association of Certified Fraud Examiners
Practitioner training content
PARTIAL
Ongoing
Practitioner training content, white papers, and certification curricula covering current AML and fraud schemes. Useful as ground truth for analyst training and as a source of emerging typology discussion.
How Themis uses this
Training materials cross-referenced when AG-02 drafts new typology spec to ensure terminology aligns with practitioner usage.
Internal SAR data
Bank's own Suspicious Activity Report corpus
Institution-specific patterns
CONFIDENTIAL
Continuous (real-time)
Institution-specific patterns derived from filed SARs. The single richest source of patterns that actually match the bank's customer base and product mix. Confidential by definition.
Resources
How Themis uses this
Primary source for TYP-EFM-001 (47 internal SARs Aug 2024–Apr 2025) and TYP-RNS-002 (128 SARs). Daily SAR ingestion by AG-07 feeds calibration of all typologies.
Vendor platforms
Commercial AML platform scenario libraries
Pre-built scenario libraries
COMMERCIAL
Licensed (vendor updates)
Pre-built scenario libraries from vendors like NICE Actimize, Oracle FCCM, SAS, NetReveal. Provide starting-point detection logic but are typically generic and require institution-specific tuning.
How Themis uses this
Actimize is the production case-management system. Shadow alerts from TYP-CMLN-003 are compared against Actimize rule output to measure novelty (47% novel today).
FIU · Operational View
Alert Workbench
Today's flagged transactions grouped by typology. Click a typology to expand its alerts. Click any alert to see the full explanation — the system shows you exactly which behavioral components fired, with the underlying transaction evidence.
Flagged today
44
▲ 18% vs. 7-day avg
High severity
17
requires SAR review
Avg disposition time
42m
analyst close-out time
Transactions scanned
2.41M
last 24h · 99.8% coverage
Alerts by Typology Today · 2026-05-16
TYP-FNL-001 Geographic Funnel Account with Cash-Wire Velocity
14 alerts today · $1,654,180 aggregate · FinCEN FIN-2014-A005
7-day volume
00:08
ALT-2026-05-018491
Western Logistics Group
$85,144
MEDIUM
00:11
ALT-2026-05-018490
Liberty Wholesale Group
$154,883
HIGH
00:14
ALT-2026-05-018489
Atlas Trade Solutions
$100,058
MEDIUM
00:17
ALT-2026-05-018488
Summit Wholesale
$91,724
MEDIUM
01:20
ALT-2026-05-018487
Cardinal Imports Inc
$113,732
MEDIUM
+ Show all 14 alerts (9 more)
TYP-RNS-002 Romance Scam Layering via Crypto On-Ramp
11 alerts today · $342,518 aggregate · 128 internal SARs + DOJ Press Release 2025-09
7-day volume
00:10
ALT-2026-05-018477
Patricia Whelan
$53,420
HIGH
00:14
ALT-2026-05-018476
Margaret O'Connell
$32,238
HIGH
00:18
ALT-2026-05-018475
Eleanor Ashcroft
$42,203
HIGH
00:22
ALT-2026-05-018474
Beatrice Kowalski
$32,919
HIGH
01:26
ALT-2026-05-018473
Dorothy Mendelsohn
$22,071
MEDIUM
+ Show all 11 alerts (6 more)
TYP-EFM-001 Elder Fraud Mule via P2P Aggregation
9 alerts today · $538,236 aggregate · 47 internal SARs · Aug 2024 — Apr 2025
7-day volume
00:15
ALT-2026-05-018500
Tyler Brennan
$76,698
HIGH
00:19
ALT-2026-05-018499
Brittany Davis
$44,078
MEDIUM
00:23
ALT-2026-05-018498
Devon Park
$62,911
HIGH
01:27
ALT-2026-05-018497
Destiny Williams
$51,826
MEDIUM
01:31
ALT-2026-05-018496
Ashley Reyes
$77,086
HIGH
+ Show all 9 alerts (4 more)
TYP-CMLN-003 Chinese Money Laundering Network — Student Account Pattern SHADOW · day 38/60
6 alerts today · $313,647 aggregate · SHADOW · FinCEN FIN-2025-A003
7-day volume
00:15
ALT-2026-05-018466
Chao Liu
$64,573
HIGH
00:20
ALT-2026-05-018465
Bo Yang
$68,993
HIGH
00:25
ALT-2026-05-018464
Jian Zhang
$43,170
MEDIUM
01:30
ALT-2026-05-018463
Wei Chen
$45,408
MEDIUM
01:35
ALT-2026-05-018462
Ling Wong
$45,841
MEDIUM
+ Show all 6 alerts (1 more)
TYP-HTR-001 Human Trafficking — Hotel & Transport Patterns
4 alerts today · $32,832 aggregate · FinCEN FIN-2020-A008
7-day volume
00:12
ALT-2026-05-018460
Daniel Reeves
$7,117
MEDIUM
01:16
ALT-2026-05-018459
Anthony Castro
$10,923
MEDIUM
Yest 22:22
ALT-2026-05-018458
Vincent Park
$6,729
MEDIUM
Yest 22:18
ALT-2026-05-018457
Marcus Webb
$8,063
MEDIUM
Alert Detail click any alert
Platform · System View
Agent Observatory
Live state of every agent in the Themis typology system, with activity feed, throughput, and recent decisions. The Observatory is where platform engineers and FCC leadership monitor system health.
Agents online
7
of 8 · AG-08 idle
LLM calls · 24h
147
$8.42 · within budget
Errors · 24h
3
all auto-recovered
Pending review
1
FIN-2026-A002 binding
Agent Roster 8 agents
AG-01
● ACTIVE
Ingestion Agent
Crawler & change detector
Data Engineering
Sources monitored
147
Last change detected
FIN-2026-A002 · 14:22 UTC
Avg crawl interval
15 min
VIEW ARCHITECTURE →
AG-02
● ACTIVE
Parsing Agent
Reader & spec author
LLM Heavy
Documents today
3
LLM cost · 24h
$2.18
Avg parse time
3.5 min
VIEW ARCHITECTURE →
AG-03
⚠ REVIEW
Data Binding Agent
Grounder & ontology builder
LLM + Retrieval
Bindings today
7
Reuse rate
71%
Pending review
2 concepts (TYP-PIG-001)
VIEW ARCHITECTURE →
AG-04
● ACTIVE
Translation Agent
Compiler & validator
LLM Codegen
Queries today
2
Backtest pass
100%
Avg gen time
8 min
VIEW ARCHITECTURE →
AG-05
● ACTIVE
Pattern Discovery Agent
Unsupervised observer
Graph + Clustering
Active clusters
4
Candidates surfaced
1 (ML-2026-Q1-44)
Last drift event
TYP-HTR-001 · today
VIEW ARCHITECTURE →
AG-06
● LIVE
Runtime Detection Agent
Executor
Deterministic
Alerts emitted
44 today
Evaluation rate
28,400/min
Coverage
99.8%
VIEW ARCHITECTURE →
AG-07
● ACTIVE
SAR Mining Agent
Internal narrative analyst
LLM Heavy
SARs ingested today
23
Patterns surfaced
2 novel
LLM cost · 24h
$3.42
VIEW ARCHITECTURE →
AG-08
⚠ REVIEW
Calibration Agent
Threshold tuner
Statistical
Proposals open
1
Awaiting approval
TYP-HTR-001
Projected FP impact
−0.0035 pp
VIEW ARCHITECTURE →
Activity Feed live
02:14:33
AG-06
Alert ALT-2026-05-018496 emitted → routed to Actimize case queue
02:13:55
AG-06
TYP-EFM-001 v1.0.0 evaluated 47,283 accounts in last batch; 9 alerts emitted
02:09:12
AG-06
TYP-FNL-001 v1.2.0 evaluation complete; 14 alerts emitted today
01:58:04
AG-07
Processed SAR-2026-05-1142; pattern matches TYP-EFM-001 (95.2%)
14:22:18
AG-01
FinCEN advisory FIN-2026-A002 detected · 847 KB · routed to AG-02
01:28:47
AG-07
SAR-2026-05-1141 pattern does not match existing typologies — flagged for clustering
00:51:09
AG-05
Cluster ML-2026-Q1-44 confidence improved from 0.71 to 0.78
00:14:55
AG-06
TYP-CMLN-003 v0.3.0 (SHADOW) emitted shadow alert SA-2026-05-3382; novel vs Actimize
23:18:42
AG-03
Concept C.ELDERLY_COUNTERPARTY reused from registry (binding BIND-0117)
22:47:11
AG-04
Backtest TYP-EFM-001 v1.0.0 against 90d historical: recall 94.2%, FP 0.018%
22:12:33
AG-06
Live evaluation rate: 28,400 txn/min
15:08:22
AG-05
TYP-HTR-001 calibration drift detected: FP trending 0.012% → 0.016% (7d)
Platform · Knowledge View
Typology Library
Every typology in the library, versioned and governed. Each skill is a three-layer artifact: institution-agnostic specification, institution-specific data binding, and executable detection logic. Drafted by agents, reviewed by FIU, promoted by MRM.
Production typologies
11
live & generating alerts
From advisories
4
FinCEN, OFAC, FATF
From SAR mining
2
internal narratives
Active 11
Draft 2
Retired 3
Active Typology Ontology click to explore
TYP-EFM-001v1.0.0
Elder Fraud Mule via P2P Aggregation
PRODUCTION SAR Mining·9 today
TYP-FNL-001v1.2.0
Geographic Funnel Account with Cash-Wire Velocity
PRODUCTION Regulatory Advisory·14 today
TYP-RNS-002v2.1.0
Romance Scam Layering via Crypto On-Ramp
PRODUCTION SAR Mining·11 today
TYP-HTR-001v1.4.0
Human Trafficking — Hotel & Transport Patterns
PRODUCTION Regulatory Advisory·4 today
TYP-RCD-010v1.0.0
Rapid Cash Deposits — Multi-Branch
PRODUCTION Regulatory Advisory·4 today
TYP-STR-011v1.1.0
Structured Cash Deposits
PRODUCTION Regulatory Advisory·5 today
TYP-VEL-012v1.0.0
Transaction Velocity Spike
PRODUCTION SAR Mining·7 today
TYP-RND-013v1.0.0
Round-Amount Transfer Pattern
PRODUCTION SAR Mining·3 today
TYP-IWT-014v1.2.0
International Wire — High-Risk Jurisdiction
PRODUCTION Regulatory Advisory·6 today
TYP-KWD-015v1.0.0
High-Risk Keyword in Memo
PRODUCTION SAR Mining·8 today
TYP-CRC-016v1.0.0
Circular Money Movement
PRODUCTION Regulatory Advisory·2 today
Skill Schema Select a typology
Drafts Awaiting Human Review 1 draft · 1 ML candidate
Pig Butchering — Online Trust Building to Crypto Investment Fraud
TYP-PIG-001 v0.1.0 · Drafted from FinCEN FIN-2026-A002 · awaiting review
Customer (typically 55+, recently widowed/divorced/isolated) makes escalating wire transfers to crypto exchanges or new MSBs they have no prior history with, after a new online relationship.
4 behavioral components 2 new concepts requiring binding 3 approvals needed before shadow Drafted: 14 min ago by AG-02
ML Pattern Discovery
Trade Invoice Manipulation — Electronics Corridor
TYP-TRD-007 · ML Pattern Discovery · Cluster ML-2026-Q1-44
Trade invoices for electronics consistently over the market median by 30%+, paid to recently-formed entities with no prior corridor activity.
Cluster confidence
0.78
Evidence points
147
First detected
Q1 2026
Trend
↑ Improving
Retired Typologies 3 retired · MRM-archived · no longer generating alerts
Typology ID
Name
Retired
Successor
Last alerts
TYP-LCK-002v1.3.0
RETIRED
Locker Box Cash Pattern
Branch safe-deposit-box visits correlated with sub-threshold deposits — superseded by broader structuring detection.
Jan 18, 2025
TYP-STR-011
Jan 17, 2025
TYP-MUL-005v2.0.0
RETIRED
Money Mule Account · Generic
Generic mule detection — replaced by demographic-aware TYP-EFM-001 (Elder Fraud Mule via P2P Aggregation). Higher precision, lower FP rate.
Nov 04, 2024
TYP-EFM-001
Nov 02, 2024
TYP-WIR-008v1.4.0
RETIRED
Generic Wire Transfer Anomaly
Broad wire-anomaly typology — split into two more specific detectors for international corridors and layering cycles. Original retired Aug 2025.
Aug 22, 2025
TYP-IWT-014 TYP-CRC-016
Aug 20, 2025
Retired typologies remain in the MRM audit ledger for 7 years. Detection code and validation reports are archived at s3://themis-archive/typologies/retired/. Click any successor tag to open the active replacement in the library.
Platform · Knowledge Graph
Atlas
Cross-typology map of the building blocks. Every abstract concept (C.*) is shown with the typologies that bind it; every behavioral component (BC*) is grouped under its parent typology. Concepts shared across typologies are the reuse leverage of the library.
Unique concepts
deduped registry
Behavioral components
across all typologies
Shared concepts
used in 2+ typologies
Concepts expand all · collapse all
Behavioral Components grouped by parent typology · expand all · collapse all
Concept × Typology Coverage filled cells = concept is bound in that typology · shared concepts only
Platform · Workflow View
Harvesting
Follow a new FinCEN advisory through the system — from RSS detection, to typology drafting, to FCC review, to shadow validation, to production. This is the lifecycle that governs every skill in the library.
New advisory detected · awaiting Financial Crimes review
FinCEN advisory FIN-2026-A002 on Pig Butchering schemes was detected 14 minutes ago. The system has parsed it into a draft typology (TYP-PIG-001) and surfaced binding decisions for your review.
1
Detected
2
Parsed
3
Bound
4
FCC Review
5
Shadow
6
Production
01
Change detected at source
COMPLETE AG-01 Ingestion Agent·2026-05-15 14:22:18 UTC

The Ingestion Agent watches 147 sources for changes via RSS feeds, scheduled crawls with hash comparison, and email parsing for subscription notifications. At 14:22 UTC yesterday, the FinCEN advisory feed produced a new entry not in the previous crawl.

DETECTED ARTIFACT SHA256 VERIFIED
Sourcefincen.gov · /resources/advisories/fincen-advisory-fin-2026-a002
Document IDFIN-2026-A002
TitleAdvisory on Pig Butchering Schemes Targeting U.S. Investors
Size847 KB · PDF · 14 pages
Hashsha256:9a2f8c34ef...e44d2891
02
Document parsed into typology spec
COMPLETE AG-02 Parsing Agent·4 min elapsed · $0.84 LLM cost

The Parsing Agent reads the advisory narrative and produces a structured typology specification. Click "Run live" to actually run this against the LLM API and watch the agent produce the spec in real time.

Source narrative
Extracted typology
▶ Run live (LLM API)
FinCEN Advisory FIN-2026-A002 · Excerpt On May 12, 2026, the Financial Crimes Enforcement Network (FinCEN) issues this advisory to alert U.S. financial institutions to a continued and evolving threat from "pig butchering" investment fraud schemes targeting American investors, with proceeds frequently moving through unregulated cryptocurrency platforms. Pig butchering schemes typically begin with the perpetrator establishing a relationship with the victim through dating applications, social media, or unsolicited messaging platforms. After cultivating trust over weeks or months, the perpetrator introduces the victim to a fraudulent investment opportunity, often involving cryptocurrency trading on a fake platform controlled by the criminal organization. RED FLAGS: • Customer initiates multiple wires to cryptocurrency exchanges with which they have no prior history. • Transfer amounts that escalate over a period of weeks. • Customer recently widowed, divorced, or otherwise socially isolated, particularly above age 55. • Customer references a new relationship developed through online channels as the source of investment guidance. • Outbound transfers to small or newly-established money services businesses. • Withdrawal of retirement funds (401(k), IRA) to fund the wire transfers. • Customer becomes defensive or evasive when bank staff inquire about transfer purpose.
typology_id: TYP-PIG-001
spec_version: 0.1.0
spec_status: DRAFT
name: "Pig Butchering — Online Trust Building to Crypto Investment Fraud"

provenance:
  source_type: REGULATORY_ADVISORY
  document_id: FIN-2026-A002
  retrieved_at: 2026-05-15T14:22:18Z

narrative:
  summary: |
    Customer (typically 55+, recently widowed/divorced/isolated) makes
    escalating wire transfers to crypto exchanges or new MSBs they have
    no prior history with, after a new online relationship.

concepts:
  - C.WIRE_OUTBOUND
  - C.NEW_BENEFICIARY                  # NEW concept
  - C.CRYPTO_EXCHANGE_BENEFICIARY      # NEW concept (needs review)
  - C.ESCALATING_AMOUNTS               # NEW concept
  - C.SOCIAL_ISOLATION_AGE
  - C.RETIREMENT_WITHDRAWAL
  - C.MSB_BENEFICIARY

behavioral_components:
  - id: BC1
    name: "Multiple wires to crypto/new MSB beneficiaries"
  - id: BC2
    name: "Escalating transfer amounts (linear regression)"
  - id: BC3
    name: "Customer demographic indicator (55+, marital change)"
  - id: BC4
    name: "Retirement fund withdrawal"

combination_logic:
  expression: "BC1 AND BC2 AND (BC3 OR BC4)"

default_calibration:
  wire_to_crypto_count_60d_min: 3
  amount_growth_r_squared_min: 0.6
  age_threshold: 55
Prompt to LLM API
"You are the Parsing Agent in an AML typology learning system. Read the FinCEN advisory and extract a structured typology specification with provenance, behavioral components, concepts, combination logic, and SAR filing guidance. Output YAML."
Click "Run parsing agent" to see LLM actually parse this advisory and produce the typology spec live.
03
Concepts bound to bank data model
COMPLETE AG-03 Data Binding Agent·6 of 8 auto-bound · 2 need review

The Data Binding Agent resolves each abstract concept against the bank's data model. 6 of 8 concepts were reused from the binding registry. 2 concepts are novel and require Financial Crimes Compliance review before proceeding.

C.WIRE_OUTBOUND
Outbound wire transfer
FCT_TRANSACTIONS WHERE txn_type IN ('WIRE_OUT_FED','WIRE_OUT_SWIFT')
Reused · binding BIND-0042 · approved 2025-08-12
REUSED
C.RETIREMENT_WITHDRAWAL
401k/IRA distribution
txn_code IN ('IRA_DIST','401K_DIST') OR memo MATCHES retirement_pattern
Reused · binding BIND-0083 · approved 2025-09-04
REUSED
C.SOCIAL_ISOLATION_AGE
Age 55+ with recent marital change
CUSTOMER.age >= 55 AND marital_status_change_24m IN ('WIDOWED','DIVORCED')
Composed from BIND-0011 + BIND-0029
REUSED
C.CRYPTO_EXCHANGE_BENEFICIARY
Beneficiary is a crypto exchange or VASP
beneficiary.entity_classification IN ('CRYPTO_EXCHANGE','VASP') OR name MATCHES known_crypto_list
⚠ NEW · Confidence MEDIUM · 247 known exchanges · needs FCC review
REVIEW
C.ESCALATING_AMOUNTS
Wire amounts trending upward
LINEAR_REGRESSION(amount_usd ORDER BY txn_ts) slope > 0 AND R² ≥ 0.6
⚠ NEW · Novel feature · needs validation against historical data
REVIEW
04
Financial Crimes Compliance review
PENDING YOU Y. Bhatia (FIU Lead)·Awaiting your action

Two binding decisions and one calibration choice need your approval before TYP-PIG-001 can advance to shadow validation.

Approve binding: C.CRYPTO_EXCHANGE_BENEFICIARY
MEDIUM CONFIDENCE

The system proposes binding this concept to a combination of beneficiary entity classification flags and a curated list of 247 known crypto exchanges (sources: FinCEN MSB registry + internal counterparty review).

Coverage estimate: ~94% of crypto-exchange-bound wires based on Q1 2026 historical data
False positive risk: Some MSB-classified entities aren't crypto-focused; mitigated by name intersection
Refresh cadence: Monthly review; new VASP registrations auto-added
Approve novel feature: C.ESCALATING_AMOUNTS regression
NEW FEATURE

This is a new statistical feature — linear regression on wire amounts in a 60-day window, requiring positive slope and R² ≥ 0.6. Validated against historical SARs: 87% of romance-investment SARs from 2025 would have triggered.

Validation method: Replay against 156 historical pig-butchering-adjacent SARs from 2024–2025
Recall on training set: 87% (136 of 156)
FP analysis: Triggers on 0.04% of normal wires (small business growth, periodic investments)
Approve initial calibration for shadow run
CALIBRATION

Proposed initial calibration. These thresholds will be re-tuned automatically during shadow operation based on observed alert distribution.

wire_to_crypto_count_60d
≥ 3
amount_growth_R²
≥ 0.60
age_threshold
≥ 55
retirement_withdrawal_min
≥ 1
shadow_window
60 days
projected_alerts/week
~12–18
✓ All approvals received · Ready to promote to shadow
05
Shadow validation · 60-day window
PENDING APPROVALSAG-04 + AG-06

After approval, the Translation Agent generates the Spark SQL detection query and the Runtime Agent runs it in shadow mode — against live transactions, but not generating analyst-visible alerts. Shadow alerts will be compared daily against Actimize output to measure overlap, novelty, and calibration accuracy.

06
Promotion to production
PENDING SHADOWMRM Committee + FCC Head

If shadow validation meets quality thresholds, the typology is promoted to PRODUCTION by joint approval of the MRM committee and FCC head. From that moment, alerts route to investigators via Actimize, MRM documentation is finalized and locked, and the typology becomes a permanent part of the typology library.

FIU · Conversational Interface
AI Terminal
Discuss any transaction, alert, typology, or policy question with the Themis AI. The Terminal has context on the briefing, the typology library, today's alerts, and the typology lineage. Live LLM API.
Loaded in context
All 44 alerts (today)
5 typologies · full evidence + transactions
All 7 typologies
Layer 1/2/3 · concepts, bindings, code
Shadow report · ML cluster · 23 SARs
All briefing context
Try asking
T
Themis AI
I have the full data loaded — all 44 alerts from today, all 7 typologies (with their Layer 1/2/3 detail), the shadow report for TYP-CMLN-003, the ML cluster ML-2026-Q1-44, and the 23 SARs processed overnight by AG-07. Ask me about any specific customer, alert, or typology by name or ID. I'll only answer with what's actually in the data.
Platform · Discovery View
ML Pattern Discovery
Cluster ML-2026-Q1-44 · Trade Invoice Manipulation — Electronics Corridor · Discovered 2026-01-22 by AG-05 (Pattern Discovery Agent)
Recommendation
Draft typology TYP-TRD-007 from this cluster. Confidence has crossed promotion threshold (0.75+) and external corroboration supports the pattern. Recommended next step: AG-02 Parsing Agent generates typology spec from cluster evidence; FCC reviews novel bindings; then proceed to shadow validation.
1 · Cluster Confidence Trendlast 5 evaluations
Current confidence
0.78
↑ from 0.61 initial
Promotion threshold
0.75
crossed ✓
Evidence points
147
accumulated over 4 months
Novelty
NOVEL
NOVEL — not covered by existing typologies or known regulato…
Trend
2 · Pattern Characteristics

Wire payments to small electronics importers in Hong Kong, Singapore, and UAE for invoices that are systematically 30-45% above the corridor median price for the declared HS code (8517 — telephone/communication equipment).

Duration observed
Pattern observed continuously since November 2025
Transaction count
423
Affected accounts
14
Aggregate value
$8.2M
3 · Supporting Featuressignals discovered by AG-05
Invoice amount vs HS code median 30-45% above benchmark in 87% of cases STRONG
Beneficiary entity age All beneficiaries registered within last 18 months STRONG
Wire amount clustering Within 5% of each other across 3+ wires (89% of accounts) STRONG
Corridor concentration 100% Hong Kong, Singapore, UAE — no other jurisdictions MODERATE
Customer industry alignment Customers declare wholesale/retail electronics — checks out on surface WEAK
4 · Comparison to Existing Typologies
TYP-FNL-001 DISTINCT
Geographic Funnel — different mechanism (cash-deposit driven)
Generic TBML typologies PARTIAL OVERLAP
Captures over-invoicing but not the specific HS-code-aware pattern
OFAC trade red flags PARTIAL OVERLAP
Some overlap on corridor but no entity-age signal
5 · External Corroboration
  • ICE HSI trend report (Q1 2026): mentions electronics over-invoicing as emerging TBML pattern
  • FinCEN Trade-Based Money Laundering advisory FIN-2010-A001 (general framework)
  • Egmont Group ML through trade — Hong Kong corridor sanctions risk noted
6 · What It Would Take to Productionize
New concepts
3
to define in Layer 1
New bindings
4
to author for Layer 2
Effort estimate
10-14 days (typology spec + bindings + initial calibration)
to full draft
Data dependencies
  • Reference table: REF_HS_CORRIDOR_MARKET_PRICE (does not exist)
  • Reference table: REF_ENTITY_REGISTRATION_HISTORY (partial — needs enrichment)
  • Memo field NLP extraction for HS code (existing capability)
Ask Themislive
T
Discuss this cluster
ML-2026-Q1-44 context loaded
T
I have the full cluster analysis in context — 147 evidence points, 0.78 confidence, novel TBML pattern in electronics corridor. Want me to help assess whether to draft TYP-TRD-007?
Platform · Learning View
SAR Ingestion Report
2026-05-15 to 2026-05-16 · 23 SARs processed by AG-07 (SAR Mining Agent) · LLM cost $3.42 · processing time 47 min
Mapped to existing
21
strengthens current typologies
Pattern-novel
2
candidates for new typologies
LLM cost
$3.42
within budget
Processing time
47 min
avg 2 min per SAR
1 · Mapped to Existing Typologies21 of 23 SARs
TYP-EFM-001
Confidence: 92-97%
6
Example (SAR-2026-05-1142): Subject (28yo, declared barista) received 17 inbound P2P from elderly senders, then forwarded structured amounts to layering beneficiary — classic EFM pattern
TYP-FNL-001
Confidence: 89-94%
5
Example (SAR-2026-05-1139): Auto repair shop receiving cash deposits across 4 states, pass-through to Hong Kong
TYP-RNS-002
Confidence: 91-96%
4
Example (SAR-2026-05-1144): Widowed customer age 72 sending escalating wires to crypto exchange following online relationship
TYP-HTR-001
Confidence: 85-91%
3
Example (SAR-2026-05-1135): Hotel charge pattern in known corridor cities with cash deposit matching
TYP-CMLN-003
Confidence: 88-92%
3
Example (SAR-2026-05-1140): Student visa account, deposits exceeding declared income, cashier check pattern
2 · Novel Patterns2 patterns not in current library
SAR-2026-05-1141 · NOVEL PATTERN
Platform-Shell Layering Pattern
Novelty score
0.84
Analyst summary: Subject is a 34-year-old accountant who received approximately $180,000 over 4 months from a single online platform 'OnlyFans Holdings LLC' (not actual creator earnings — pattern suggests platform is being used as a layering shell). Subject then forwarded funds in equal weekly installments to three unrelated personal accounts at different banks, with memos referencing 'consulting'. No actual consulting business registered.
Agent assessment: Pattern does not match existing typologies. Closest is TYP-EFM-001 but mechanism is different (single source, not aggregation). Suggest creating cluster CL-2026-05-NEW-08 to monitor for similar patterns.
Filed by: M. Patel
SAR-2026-05-1138 · NOVEL PATTERN
Government Impersonation Elder Fraud
Novelty score
0.79
Analyst summary: Subject (61yo, retired teacher) made 11 withdrawals from ATM in $400-$500 amounts over 3 weeks, then purchased prepaid debit cards at gas stations in same amounts. Total ~$5,400. Stated to teller that she needed cards to 'help a relative pay tax bill to IRS' — strong indicator of IRS-impersonation elder fraud scheme.
Agent assessment: Different victim profile/mechanism than TYP-EFM-001 (subject is the victim, not a mule). Pattern matches FinCEN advisory FIN-2014-A001 (government impersonation scams). Suggest drafting typology TYP-IRS-IMP-001.
Filed by: K. Robinson
3 · Next Actions
  • 21 mapped SARs added to training set — will refresh existing typology calibration on next AG-08 cycle
  • 2 novel patterns surfaced to clustering review by AG-05
  • SAR-2026-05-1141 recommended for new cluster CL-2026-05-NEW-08 — monitor for similar patterns
  • SAR-2026-05-1138 may justify new typology TYP-IRS-IMP-001 if more cases surface
Ask Themislive
T
Discuss this report
23 SAR analysis loaded
T
I've analyzed all 23 SARs ingested overnight. 21 strengthen existing typologies (training data); 2 are pattern-novel candidates. The platform-shell layering pattern (SAR-1141) and IRS-impersonation elder fraud pattern (SAR-1138) both warrant attention. Want me to walk you through either?
Platform · Agent Architecture
Agent Architecture
Select an agent to view its architecture.
Loading agent detail…
AML Alert · Alert Queue
Alerts under investigation
Active alerts from the AML detection pipeline. Click a row to open the full investigation workspace — customer profile, timeline, network graph, agent journal, and final narrative.
Open alerts
6
across 6 customers
High / Critical
2
requires SAR review
Cleared
3
auto-disposition
Aggregate flagged
$2.5M
inflow exposure
Alert Queue click a row to open the investigation workspace
Alert ID
Date
Customer
Typologies
Txns
Flagged
Inflow
Decision
Re-Investigate
AML Alert · Transactions
Live transaction feed
Streaming tape of every transaction processed across all open AML alerts. New events arrive at the top — flagged events fire instantly as the typology engine matches a pattern. Pause anytime to investigate.
Flagged
requires analyst review
Total inflow
credit volume
Total outflow
debit volume
LIVE 0.0 tx/s · 0 in last 60s Streamed 0 Flagged 0
Filter:
Txn ID
Arrived
Description
Counterparty
Country
Amount
Balance
Flag
0 new
AML Alert · Case Management
Active cases
Cases bundle one or more alerts into a formal investigation with assignee, deadline, supporting documents, and (if required) a linked SAR draft.
Open / Critical
priority cases
Under review
investigator analysis
Total documents
evidence on file
Case Queue click any case for full investigation workspace
AML Alert · Suspicious Activity Reports
SAR queue
Suspicious Activity Reports drafted by Themis AI with editable narratives, QC checks, and an audit trail. Each SAR is linked to its originating case and customer.
SAR Queue click any SAR to open the narrative editor
Workflow · Change Request
Change request
An edit to an existing production typology, routed through Financial Crimes review and shadow validation before promotion.
AML Alert · Real-time
AML Screening & Intelligence
Sanctions · PEPs · Adverse Media · Enforcement — every customer and counterparty screened against external watchlists and intelligence feeds, with explainable hits.
Potential / Hits
require analyst review
No match
cleared automatically
Entity hits
non-individual
Entity
Type
Kind
Match
Score
Source · details
Action
⌖ Screening Hit
Platform · Infrastructure
Data source configuration
Transaction data ingestion · ETL pipelines · Streaming platforms · External intelligence feeds. Every source the typology runtime reads from.
Connected
live ingestion
Disconnected
action required
Real-time feeds
streaming
Connected Data Sources click Configure or Connect
Source
Vendor
Type
Volume
Latency
Status
Last sync
Actions
+ Draft new typology
How would you like to draft this typology?
Pick a source. The system will run the matching agent (AG-02 / AG-05 / AG-07) and seed the editor for you.
⚑ Change Request · submitting for review
Typology change
CR-—
⚙ Reuse Agent · LCEL chain
Suggest a reusable abstract concept
Describe what the typology needs to detect, and the agent will check the concept registry for matches before proposing a novel concept.
Seed text · what are you trying to express?
Chain trace
contextBuilder— pull registry + draft state
retriever— keyword overlap → top-K candidates
promptBuilder— assemble system + user prompt
llm— Claude · structured JSON
jsonParser— bucket into reuse / compose / novel
Pipeline · contextBuilder | retriever | promptBuilder | llm | jsonParser

Retire typology