RedFlag — AML / Risk Compliance Agent System

Multi-agent system for AML transaction monitoring, KYB onboarding, and risk compliance using public data sources.

Architecture

Alert / Entity Input
        ↓
  Triage Agent
        ↓
  ┌─────┴──────────────────────┐
  │  Enrichment Layer          │
  │  ├─ LEI Identity           │
  │  ├─ Sanctions Screening    │
  │  ├─ Adverse Media (GDELT)  │
  │  ├─ INTERPOL (optional)    │
  │  └─ Counterparty Enrichment│
  └─────┬──────────────────────┘
        ↓
  Risk Scoring Agent
        ↓
  Narrative / Memo Agent
        ↓
  Case Bundle (MD + JSON)

Data Sources (all public, no API keys required)

Source	Purpose	API
GLEIF	Corporate identity via LEI	api.gleif.org
OFAC	Sanctions screening (SDN list)	sanctionslist.ofac.treas.gov
GDELT DOC 2.0	Adverse media (article search)	api.gdeltproject.org/api/v2/doc
GDELT Context 2.0	High-precision sentence search	api.gdeltproject.org/api/v2/context
INTERPOL	Red notices (optional)	ws-public.interpol.int

Directory Structure

config/           Policy config (thresholds, jurisdiction lists)
skills/           Atomic capabilities (API calls, parsing, scoring)
agents/           Agent definitions (KYB onboarding flow)
  monitoring/     Alert triage + case packaging
  transaction_monitoring/  TM-specific agents
features/         Supplementary tools (doc generator, RFI, playbooks)
playbooks/        Typology playbooks (structuring, layering, etc.)
demo/             Synthetic demo scenarios

Agent Categories

KYB / Onboarding Agents

1. entity_intake_agent — Collects minimum viable entity fields
2. lei_identity_agent — Resolves corporate identity via GLEIF
3. ownership_structure_agent — Builds ownership view from GLEIF Level 2
4. sanctions_screening_agent — Screens against OFAC SDN
5. osint_adverse_media_agent — Searches GDELT for adverse signals
6. kyb_risk_assessment_agent — Deterministic risk scoring + case summary

Monitoring / Alert Agents

7. alert_triage_agent — Classifies alerts by typology, routes enrichment
8. case_packaging_agent — Produces regulator-friendly case bundles
9. interpol_notice_agent — Optional high-signal enrichment

Transaction Monitoring Agents

10. behavioral_anomaly_agent — Profile deviation + velocity analysis
11. counterparty_enrichment_agent — LEI + sanctions + media on counterparties
12. flow_analysis_agent — Transaction chain + fan-in/fan-out detection
13. prior_case_reasoning_agent — Summarizes prior alerts + delta analysis
14. narrative_draft_agent — Generates investigation narratives
15. memo_builder_agent — Decision justification + STR/NFA reasoning

Supplementary Features

• Investigation document generator (structured Word-ready output)
• Playbook router (maps alerts to typology playbooks)
• RFI checklist generator (source of funds/wealth questions)
• Profile consistency checker (rules-based)
• Decision justification assistant (regulator-ready language)

Human-in-the-Loop

Every agent enforces needs_human_review when:

• Ambiguous identity matches (2+ LEI candidates)
• Sanctions near-matches without corroboration
• Common-name collisions in adverse media
• INTERPOL hits without DOB/nationality alignment
• Any possible_match flag in scoring

Quick Start

See demo/ for synthetic scenarios that exercise the full pipeline:

• Structuring (cash deposits below reporting threshold)
• Foreign wires (profile mismatch)
• Rapid fund movement (layering to crypto)
• Teller suspicion trigger (behavioral)
• Human trafficking indicators