Skip to content

Multi-Jurisdiction Support

The framework supports geo-based default policies — the same architecture adapts to different regulatory regimes based on the jurisdiction field in aml.yaml. The dashboard Framework Alignment tab switches CA/EU specially; other jurisdictions fall back to FinCEN BSA-style tabs. Regulator export formats are per-jurisdiction: goAML (FATF/FINTRAC), CA-FINTRAC audit pack, and AMLA RTS draft (EU — non-submittable pending final RTS). See the individual export commands in the API/CLI reference.

Bundled Example Specs

Spec Jurisdiction Regulator Filing Types
examples/community_bank/aml.yaml US FinCEN SAR, CTR
examples/community_bank_lookback/aml.yaml US FinCEN SAR, CTR (look-back / re-run variant)
examples/canadian_bank/aml.yaml CA FINTRAC STR, LCTR, EFTR
examples/canadian_schedule_i_bank/aml.yaml CA FINTRAC + OSFI STR, LCTR (TD case-study patterns)
examples/eu_bank/aml.yaml EU EBA EU STR (AMLD6)
examples/uk_bank/aml.yaml UK FCA UK SAR (POCA 2002)
examples/cyber_enabled_fraud/aml.yaml US FinCEN/FATF SAR + investment-scam typology
examples/crypto_vasp/aml.yaml Cross-border FATF R.16 / FinCEN / FINTRAC VASP STR/SAR (network_pattern + Travel Rule)
examples/trade_based_ml/aml.yaml US FinCEN + FATF/Egmont SAR with TBML typology indicators (Round-7)
examples/uk_app_fraud/aml.yaml UK FCA + PSR + NCA UK SAR + PSR reimbursement decision (Round-7)
examples/us_rtp_fednow/aml.yaml US FinCEN / RTP / FedNow RTP/FedNow push-fraud detector pack (Round-8)
examples/austrac_tranche_2_dnfbp/aml.yaml AU AUSTRAC SMR + TTR (Tranche 2 DNFBPs — #500)
examples/genius_ppsi_issuer/aml.yaml US FinCEN (GENIUS Act) SAR (PPSI stablecoin issuer — #500)
examples/genius_ppsi_stablecoin/aml.yaml US FinCEN + OFAC (GENIUS Act PPSI NPRM) SAR + proposed PPSI CTR (richer NPRM-grounded stablecoin spec — #513)

All fourteen execute the same engine; the jurisdictional differences live in: - the regulation_refs citations on each rule - the workflow queue names + filing forms - the dashboard's Framework Alignment tab content - the export format (goAML for FATF/FINTRAC/generic, AMLA RTS draft for EU)

United States — FinCEN / BSA

The US specs (community_bank, cyber_enabled_fraud) align with:

  • 31 CFR 1010 — Bank Secrecy Act recordkeeping and reporting requirements
  • FinCEN's 2024 effectiveness rule + 2026 supervisory guidance — measures program effectiveness in terms of investigations, not raw alert counts (drives the investigation aggregator)
  • FinCEN BSA 6 Pillars including the April 2026 proposed 6th pillar (formalized risk assessment)
  • OFAC SDN list screening via the list_match rule type
  • FinCEN advisories (FIN-2014-A005 cash-to-wire, FIN-2023-Alert005 pig-butchering, FIN-2006-A003 unusual volume)
  • FinCEN Whistleblower Incentives and Protections NPRM (Federal Register 2026-06271) — the offline aml whistleblower-audit CLI (#531) rolls a run's audit ledger into a frozen whistleblower_audit_report.json (SAR-backlog exposure, escalation coverage, triage time, board-documented decisions, ledger integrity) + a --format nprm-gap readiness table. Advisory readiness lens; never blocks or changes a run. See how-to: run a whistleblower audit.

Filing forms: SAR (Suspicious Activity Report) and CTR (Currency Transaction Report) for cash >$10,000.

aml dashboard examples/community_bank/aml.yaml

Canada — FINTRAC + OSFI

The Canadian specs (canadian_bank, canadian_schedule_i_bank) align with:

  • PCMLTFA (Proceeds of Crime Money Laundering and Terrorist Financing Act) and PCMLTFR — every rule citation references a specific section (e.g., PCMLTFA s.11.1 for structuring, PCMLTFR s.7(1) for LCTR obligations)
  • FINTRAC reporting forms — STR (Suspicious Transaction Report), LCTR (Large Cash Transaction Report >CAD 10,000), EFTR (Electronic Funds Transfer Report >CAD 10,000)
  • OSFI Guideline B-8 — enhanced expectations for federally regulated institutions: board oversight, automated monitoring, sanctions integration
  • PCMLTFR s.132 — 24-hour aggregation rule for cash transactions
  • 5-year retention for all records (PCMLTFR s.144-145)

The dashboard's Framework Alignment page automatically shows PCMLTFA Pillars and OSFI Guideline B-8 tabs instead of FinCEN BSA Pillars when running with a Canadian spec:

Canadian Framework Alignment

aml dashboard examples/canadian_bank/aml.yaml
aml dashboard examples/canadian_schedule_i_bank/aml.yaml  # TD case-study patterns

The canadian_schedule_i_bank spec encodes the patterns FINTRAC cited in its 2024 enforcement actions against TD (CAD 9.2M penalty) — repeated PEP transactions, structuring at the LCTR threshold, dormant-account reactivation. Useful as a reality-check for Big-six Canadian programs.

European Union — EBA / AMLD6

The EU spec (eu_bank) aligns with:

  • AMLD6 (Directive 2018/1673) — criminal liability for money laundering, expanded predicate offenses
  • EBA AML/CFT Guidelines — risk-based approach, EDD triggers, customer due diligence
  • EU Regulation 2023/1113 (Transfer of Funds) — EU implementation of FATF R.16 Travel Rule
  • AMLA (Anti-Money Laundering Authority, operational July 2026) — direct supervision of high-risk cross-border institutions
  • AMLA RTS draft (July 2026) — STR submission format
  • AMLA RTS effectiveness telemetry (#528) — the eu_bank rules carry the three AMLR effectiveness citations (CDD AMLR Art. 28(1) (CDD-information RTS), ongoing monitoring of the business relationship AMLR Art. 26 (CDD measure Art. 20(1)(f)), and targeted-financial-sanctions screening AMLR Art. 20(1)(d); all in AMLR = Regulation (EU) 2024/1624, article numbers verified against the EUR-Lex text). The offline aml amla-effectiveness-report <spec> <run-dir> command rolls a run into the alert→case→STR funnel + per-rule precision + per-article citation coverage — see How to produce an AMLA RTS effectiveness pack. STR acceptance is honestly reported as not_tracked (the run records STR filing, not regulator feedback).

Spec includes: - 7 detection rules covering structuring, high-risk-jurisdiction, PEP screening, rapid-movement, sanctions, FATF R.16 travel-rule completeness, and INVS pig-butchering - ISO 20022 purpose_code column on the txn data contract for the typology library snippets - 5-year retention per GDPR + AMLD6 art. 40

aml dashboard examples/eu_bank/aml.yaml

The framework ships a goAML 5.0.2 exporter (aml export-goaml) and an AMLA RTS JSON draft exporter (aml export-amla-str) — see api-reference.md for invocation details.

United Kingdom — FCA / POCA

The UK spec (uk_bank) aligns with:

  • POCA 2002 (Proceeds of Crime Act) — the predicate offense framework
  • MLR 2017 (Money Laundering, Terrorist Financing and Transfer of Funds Regulations) — implementing FATF R.16 in UK law
  • FCA Handbook — SYSC, FCG, and FG24/4 (APP-fraud detection expectations)
  • OFSI sanctions — UK consolidated list screening via list_match
  • UK Payment Systems Regulator (PSR) APP-fraud reimbursement (effective Oct 2024, full effect Apr 2026) — drives the pacs.004 return-reason mining library
  • FCA Mar 2026 Dear CEO letter on SAR backlogs — drives the SLA timer + escalation engine

Filing form: UK SAR to the National Crime Agency (NCA) under POCA s.330-332.

aml dashboard examples/uk_bank/aml.yaml

Fraud ↔ AML cross-program case linkage (uk_app_fraud)

examples/uk_app_fraud/aml.yaml is the bundled demonstrator of cross-program case linkage — the cases/linkage.py mechanism that surfaces a subject under parallel investigation by both the fraud team and the financial-crime (AML) team. The spec carries two alert streams over the same accounts:

  • Fraud-domain — the four APP-fraud rules (first_use_payee_large_amount, cop_mismatch_override, vulnerable_customer_atypical_payment, rapid_pass_through_mule), each tagged aml_priority: fraud.
  • AML-domain — rapid_outbound_dispersal (aml_priority: other), the AML team's POCA s.327 layering detector: ≥3 outbound CHAPS / Faster-Payments legs summing ≥£1,500 in 7 days (a rapid-dispersal layering signal; the investigator confirms the beneficiary fan-out from each leg's counterparty_account).

The planted mule C0019 trips both the fraud-domain rapid_pass_through_mule and the AML-domain layering rule, so aml run examples/uk_app_fraud/aml.yaml --seed 42 writes a case_links.jsonl artifact (manifest-pinned, frozen post-finalize) with one cross-program link, and the dashboard's Case Investigation page shows a Linked across domains row. Export the full linked-case evidence bundle with aml export (the run-dir ZIP includes case_links.jsonl).

Australia — AUSTRAC / AML-CTF Act

The Australian spec (austrac_tranche_2_dnfbp) models a Tranche 2 reporting entity — a designated non-financial business or profession (DNFBP: lawyers, accountants, real-estate agents, dealers in precious metals/stones) brought into the regime by the 2024 AML/CTF amendments. It aligns with:

  • AML/CTF Act 2006 — every AML/CTF rule citation references a specific section: s.43 (threshold transaction reports), s.41 (suspicious matter reports), s.36 (ongoing customer due diligence); sanctions screening cites the Autonomous Sanctions Act 2011 (Cth) / DFAT Consolidated List, not the AML/CTF Act program section
  • AUSTRAC reporting forms — TTR (Threshold Transaction Report, cash AUD $10,000+) and SMR (Suspicious Matter Report)
  • AUSTRAC DNFBP Guidance 2024 — sector-specific onboarding and ongoing-monitoring expectations for Tranche 2 entities
  • FATF Recommendation 22 — DNFBP customer due diligence

Key rules: cash structuring below the AUD $10,000 TTR threshold, rapid pass-through (cash-in then wire-out within 48h), outbound wires to FATF call-for-action jurisdictions (KP/IR/MM), dormant-client reactivation with sudden large activity, DFAT Consolidated List sanctions screening, and adverse-media screening. The workflow routes investigator → SMR filing → closed.

aml dashboard examples/austrac_tranche_2_dnfbp/aml.yaml

United States — FinCEN / PPSI (GENIUS Act)

The stablecoin-issuer spec (genius_ppsi_issuer) models a permitted payment stablecoin issuer (PPSI) under the GENIUS Act federal stablecoin framework. It aligns with:

  • GENIUS Act s.4 — BSA/AML program obligations for permitted payment stablecoin issuers
  • 31 CFR 1022 — money-services-business AML program and reporting requirements (1022.210 program, 1022.320 SAR / suspicious-structuring), used here as an interim MSB-baseline framing. Note: the later GENIUS Act PPSI NPRM (see the richer spec below) EXCLUDES PPSIs from the MSB definition and proposes a PPSI-specific regime (31 CFR Part 502 OFAC + proposed 31 CFR 1033 reporting); the richer genius_ppsi_stablecoin spec therefore cites that PPSI-specific authority instead of the 1022 MSB rules.
  • FinCEN FIN-2019-G001 — convertible virtual currency guidance (nested-VASP / pass-through typologies)
  • OFAC SDN — virtual currency addenda — sanctioned-wallet screening
  • FATF Recommendation 16 — Travel Rule completeness on outbound transfers

Filing form: SAR. Key rules cover the stablecoin-specific typologies: rapid mint-then-redeem within 24h, outbound transfers to FATF call-for-action jurisdictions (KP/IR/MM), suspicious structuring below the USD $10,000 reporting threshold, OFAC SDN wallet screening, nested-VASP same-day pass-through churn, and adverse-media screening.

aml dashboard examples/genius_ppsi_issuer/aml.yaml

GENIUS Act PPSI / stablecoin issuer (richer NPRM-grounded spec)

examples/genius_ppsi_stablecoin/aml.yaml is the richer companion to the basic issuer spec above, grounded in the joint FinCEN/OFAC NPRM "Permitted Payment Stablecoin Issuer AML/CFT Program and Sanctions Compliance" (Federal Register 2026-06963, published 2026-04-10; comment deadline 9 June 2026). What it adds over genius_ppsi_issuer:

  • New 31 CFR Part 502 OFAC sanctions program — the NPRM stands up a dedicated PPSI sanctions regime; the ofac_sdn_screening rule cites Part 502 explicitly (freeze-and-report on an SDN match, including the virtual-currency-address addenda).
  • ISO 20022 pacs.008 fields on the txn contract (debtor_bic, creditor_bic, uetr, purpose_code) the iso20022 ingestion adapter populates on wire/RTP rails — declared nullable so synthetic/CSV rows still load.
  • program.sla block — FinCEN SAR/CTR filing-latency SLA (alert_disposition_days: 30); the engine records breaches in sla_report.json.
  • PPSI-specific citations — the NPRM EXCLUDES PPSIs from the MSB definition, so the SAR/program rules cite GENIUS Act s.4 / the NPRM (FR 2026-06963) rather than the 31 CFR 1022 MSB rules.
  • Proposed PPSI currency-transaction report — the NPRM PROPOSES a PPSI-specific currency-transaction report (proposed 31 CFR 1033.310-315, cross-referencing the $10,000 aggregate-day threshold of 31 CFR 1010.311), modelled as the FINCEN_CTR form alongside FINCEN_SAR. This is a proposed obligation (comment deadline 9 June 2026), distinct from the generic cash CTR.

Six rules: stablecoin mixing/layering (fan-in + fan-out churn in a recent 7-day window), rapid on-ramp/off-ramp cycling (mint + redeem in a recent 7-day window), structuring below the USD $10,000 reporting threshold, VASP counterparty exposure to FATF call-for-action jurisdictions (KP/IR/MM), OFAC SDN screening (31 CFR Part 502), and adverse-media screening. The workflow routes investigator → SAR filing → closed.

aml dashboard examples/genius_ppsi_stablecoin/aml.yaml

Cross-Border / Specialty Specs

examples/cyber_enabled_fraud/aml.yaml

US-jurisdictional spec focused on the FATF Cyber-Enabled Fraud (Feb 2026) typology paper: pig-butchering / investment scams, romance scams, business email compromise, and APP-fraud convergence. Composes with the pacs.004 return-reason library for UK PSR reimbursement-mandate analytics.

examples/crypto_vasp/aml.yaml

Virtual Asset Service Provider spec aligned with FATF R.15-16 for crypto, FinCEN's FIN-2019-G001 virtual currency guidance, and FINTRAC's PCMLTFR s.7.7 (dealers in virtual currency). Built around TRM Labs' 2026 Crypto Crime Report finding that stablecoins accounted for ~84% of fraud-scheme inflows in 2025 with hold times collapsing under 48 hours.

Demonstrates two framework features that don't appear in the fiat-bank specs: - network_pattern rule type (PR #16) — detects layering through multi-hop wallet graphs - Wallet-screening list_match against data/lists/sanctioned_wallets.csv (OFAC SDN crypto addresses) - Counterparty attribution via vasp/ module (PR #55) — public-data Chainalysis alternative that maps wallet clusters to known VASPs

aml dashboard examples/crypto_vasp/aml.yaml

Spec-specific planted-positive demo data (#522)

Three of the newer specs ship with their own deterministic planted-positive synthetic data rather than inheriting the shared community-bank dataset. aml run examples/<spec>/aml.yaml --seed 42 (synthetic source) now resolves the spec's dedicated generator by program.name, so a prospective user sees only that spec's typologies — not 60 community-bank customers. Every other spec is unchanged (it falls back to the shared generate_dataset, byte-identical to before).

Spec Generator Customer band Planted typologies (one alert each)
examples/us_rtp_fednow/aml.yaml data/synthetic_rtp_fednow.py C9001–C9029 first-use large RTP send · receive-velocity spike · ramp-up-then-drain · 4-mule device fan-out (network) · unusual send-hour
examples/uk_app_fraud/aml.yaml data/synthetic_uk_app_fraud.py C9101–C9129 first-use large payee · vulnerable-customer atypical payment · CoP-mismatch override · rapid pass-through mule (PSP-switching, account < 30 days)
examples/trade_based_ml/aml.yaml data/synthetic_trade_based_ml.py C9201–C9229 over-invoicing · under-invoicing (over/under pair share an invoice corridor) · phantom shipping · multiple invoicing · TRAD-to-high-risk-jurisdiction

The generators are stdlib-only, deterministic (every amount + time offset is hardcoded; output depends only on as_of), and isolated from the community-bank C0xxx band. Seed-42 sample CSVs (anchored at as_of = 2026-06-01T12:00:00) are committed under data/input/<spec>/ for offline use:

# Synthetic (dedicated generator picked automatically by program.name):
aml run examples/us_rtp_fednow/aml.yaml --seed 42

# From the committed CSVs (pass the matching --as-of):
aml run examples/trade_based_ml/aml.yaml \
  --data-source csv --data-dir data/input/trade_based_ml \
  --as-of 2026-06-01T12:00:00

Adapting a Spec to Your Institution

The bundled specs are reference designs, not turnkey deployments. To adapt:

  1. Copy the closest jurisdictional match to a new directory under examples/ or your own repo
  2. Replace the program metadata: program.name, program.regulator, program.owner, program.effective_date
  3. Adjust thresholds — the bundled rules use indicative thresholds (e.g., USD 9,500 for structuring); your institution's risk appetite + customer base should drive the actual values
  4. Add institution-specific rules — every rule needs a regulation_refs citation; use the Typology Catalogue page or the spec/library/ snippets for starting points
  5. Wire your data contract — add columns to the txn / customer data contracts that match your warehouse schema; the engine validates schema compatibility at load time

See spec-reference.md for the field-by-field guide and audit-evidence.md for the evidence-bundle contract every adapted spec inherits.