Automate suspicious activity triage
Suspicious activity triage decides which flagged transactions warrant a report. Feed KYT review decisions into a queue, enrich each with a risk score, and confirm with a trace where needed. Store the enriched record as the basis for a SAR.
- A live API key with AML scope.
- A KYT screening feed producing review decisions.
1Collect review decisions
Route every KYT response with decision review into a triage queue. These C3 screens are the input the triage workflow consumes.
> { "decision": "review", "score": 63, "risk_level": "medium", "exposure": [{ "category": "darkmarket", "hops": 2 }] }2Enrich with a risk score
Pull the address risk score for the counterparty to add exposure context to each queued item. The exposure categories drive prioritization.
curl https://api.1st-node.com/v1/aml/eth/0x44ab.../risk \ -H "Authorization: Bearer sk_live_..."
3Confirm with a fund-flow trace
For high-priority items, run a C4 fund-flow trace to establish the path before writing a report. Reserve the trace for items that survive triage.
curl "https://api.1st-node.com/v1/intel/eth/0x44ab.../flow?dir=in&hops=3" \ -H "Authorization: Bearer sk_live_..."
4Store the triage evidence
Persist the KYT decision, risk response, and trace against each case. This assembled record is what supports a SAR filing and satisfies audit.
よくある質問
Why enrich before deciding to file?
A raw KYT review flag lacks context. Enriching with the risk score and, where warranted, a trace lets triage prioritize and gives a filing its evidentiary basis.
Should every review item get a fund-flow trace?
No. Tracing is a C4 call. Apply it only to items that survive score-based triage, not the whole queue.
続けて読む
チャージして、キーを取得し、リリース。
セルフサーブ。暗号資産またはカードで支払い。クレジットで従量課金——重いプリミティブは高く、単純なものは安価。
APIキーを取得