AutoCEN
Built on Kundi · Deployed in Banking
One system for monitoring, screening, due diligence, investigation, and filing, running entirely inside your infrastructure. Sub-50 ms risk decisions · 93%+ model AUC · 80% of AML workflows automated · files directly with FinCEN · quantum-resilient.
AutoCEN covers the financial-crime workflow from the first transaction to the filed report: fiat and crypto monitoring, sanctions screening, KYC, KYB and counterparty due diligence, customer risk tiering, case management, and SAR and CTR filing. Rules you can read make the decisions, a second person approves what matters, and everything lands on a tamper-evident audit trail. No outside AI service is called, and your data stays on your network.
-
5
government sanctions lists synced: OFAC SDN, OFAC Consolidated, UN, EU, and UK
-
895
documented API operations across 45 OpenAPI specifications
-
2 people
required to approve rule changes, country-risk changes, and regulatory filings
See AutoCEN work.
Click a window, or its green button, to read it full-screen.
Monitoring and screening you can explain.
Every alert traces back to a rule, a list entry, or a data point an analyst can open and an examiner can check.
-
Transaction Monitoring
Each fiat transaction is scored synchronously on amount, type, country, KYC status, and related risk factors. Structuring bands and an expected-activity variance job catch patterns that a single transaction hides.
-
Detection Rules Under Change Control
Rules can alert, block a customer, or open a SAR case. New rules go through maker-checker approval, dry-run, and a backtest that reports hit and false-positive rates. Only enabled production rules load, and every match is logged.
-
Sanctions Screening
Screen customers, transactions, and batches against OFAC SDN, OFAC Consolidated, UN, EU, and UK lists, with a review queue for potential matches. Lists sync on a schedule, as often as every six hours for OFAC.
-
PEP and Crime-List Screening
Politically exposed person, sanctions, and crime-related datasets feed customer screening alongside the government lists.
-
Crypto Monitoring
Layered address screening against OFAC crypto addresses, mixers, darknet markets, and bridges, with Travel Rule records. Addresses normalize across Ethereum, Bitcoin, Solana, Polygon, BNB Chain, Arbitrum, and Optimism. An optional connector adds commercial blockchain analytics.
Due diligence that keeps itself current.
Risk is rated once, with its reasons, and then kept up to date as owners, countries, and anniversaries change.
-
KYC and CIP
Customer documents, screening, and customer identification records in one place. High-risk customers route to an enhanced due diligence queue.
-
KYB and Beneficial Ownership
Business entities are checked against corporate-registry and ownership reference data, and owners are screened too. A change in beneficial ownership triggers a new risk tier.
-
Counterparty Due Diligence
Counterparties run through the same rules engine as KYB. Auto-clear happens only after a current, complete, clean screen.
-
Customer Risk Tiering
Five tiers with attribute-level rationale, so a reviewer can see why a customer sits where it does. Anniversary reviews become tasks automatically.
-
Country Risk
A band for each country sets a floor under the customer rating. Changes show their impact first and need a second person to approve.
From alert to decision, on one record.
Each role opens on its own to-do list, including the approvals waiting on it.
-
Case Management
Three or more open alerts on a subject escalate automatically. Investigators work from a disposition workbench with a full case timeline.
-
Case Automation With Guardrails
Automations can be dry-run first, and a rule that asks a question the data cannot answer is refused when it is written, not when it misfires.
-
Separation of Duties
Admin, analyst, compliance officer, auditor, and fiduciary officer roles are distinct. The maker of a change cannot be its checker.
Regulatory filing, with a person in the loop.
AutoCEN prepares the filing. People review and approve it before anything moves.
-
SAR Preparation
Forms autofill from case data and generate as FinCEN SARX batch XML, checked against the published schema in continuous integration. Long narratives split to fit the form.
-
Deterministic Narrative Drafts
Draft narratives are built by a deterministic template from case, alert, screening, and transaction data, with key findings stored for audit. An analyst reviews every draft.
-
Four-Eyes Lifecycle
Every SAR moves through draft, pending review, approved, submitted, and acknowledged, with a second approver required.
-
CTR Workflow
Real-time daily aggregation, structuring scores, and exemption management with biennial review.
-
Other BSA and OFAC Records
Form 8300, OFAC reject and blocked-property reports, 314(a) and 314(b) information sharing, and continuing-activity tracking.
-
BSA E-Filing Transport
Supports secure SFTP transmission with retry and acknowledgment handling. Live submission is switched on for your institution once your filer credentials are in place.
Examiner-ready evidence.
Hand an examiner the answer, then let them check it.
-
Sanctions coverage
Sanctions screening covers the OFAC SDN, OFAC Consolidated, UN, EU, and UK lists.
-
Reproducibility
AutoCEN is deterministic: the same inputs, model versions, and configuration always produce the same screening and risk results. Examiners can re-run any decision and get the same answer.
-
Model risk under SR 26-2
SR 26-2 (April 2026) replaced SR 21-8, the agencies' statement on model risk for BSA/AML systems. It also excludes deterministic rule-based processes with no statistical, economic or financial theory behind them from its definition of a model. Our validation pack maps each AutoCEN component against that definition so your model-risk team can decide what is in scope.
-
Audit-trail export
Every operation is recorded in a full audit trail tied to user and model version, and that trail can be exported for examiners and internal audit.
-
SAR narrative review workflow
SAR narratives go to an analyst for review, and every edit and approval is logged in the audit trail. The analyst stays the decision-maker on every filing.
Evidence built in, not bolted on.
Rules and scoring stay deterministic, so your model-risk team reviews logic it can read and results it can reproduce.
-
Tamper-Evident Audit Chain
Audit records are sealed in a SHA-256 hash chain, per entity, with a verification endpoint and printable verification report. Altering a past record breaks the chain.
-
Sealed Audit Reports
Audit reports export as PDF or CSV, and a second administrator finalizes and seals them.
-
Auditor Engagements
Give an auditor scoped access for an engagement, with export and sign-off, instead of a general login.
-
Access Records
API access and logins are recorded with IP address and reviewable on an access and activity screen.
-
Versioned Rules and Models
Rule versions keep their history. A model registry holds artifacts and backtests, and models are promoted deliberately. Responses identify the model source behind them.
-
Regression-Tested Scoring
Scoring runs against golden test vectors, so a change that shifts a result is caught before release. Shadow scoring can compare a candidate model and never affects a decision.
-
AI Does Not Decide
Deterministic rules act and people approve. No language model makes a compliance decision, and none is called outside your environment.
Built around the rules your examiners cite.
Workflows reference the specific requirements they support. Coverage for your institution is mapped during the readiness assessment.
-
Bank Secrecy Act
SAR and CTR workflows, exemptions under 31 CFR 1020.315, customer identification under 31 CFR 1020.220, beneficial ownership under 31 CFR 1010.230, and Form 8300 under 31 CFR 1010.330.
-
USA PATRIOT Act §314
Information-sharing workflows under 31 CFR 1010.520 and 1010.540.
-
OFAC
List screening plus blocked-property and reject reporting records under 31 CFR 501.603 and 501.604.
-
FATF and the Travel Rule
Jurisdiction reference data for country risk, and Travel Rule records for crypto transfers.
Your hardware, your choice of packaging.
AutoCEN installs in your environment and runs under your control.
-
Packaging
A signed native Linux package with systemd, Podman, Compose, Helm for Kubernetes, or an offline container bundle.
-
Topologies
Start on a single server or run a three-tier deployment, with your own or a managed PostgreSQL database.
-
Availability
A warm standby with documented manual failover, backed by an operations runbook.
-
Air-Gap Capable
Runs without outside connectivity. In an air-gapped site you supply the sanctions and reference-data updates through your own transfer process.
Fits the stack you already run.
Connections to your core and data systems are scoped with your team during the assessment.
-
APIs and Events
REST APIs with OpenAPI specifications for each service, and Kafka for event flows.
-
Payment Messages
Parses SWIFT MT103, MT202, and MT199 and ISO 20022 pacs.008, pacs.009, and pain.001.
-
Identity and Access
Native OIDC single sign-on, TOTP multi-factor authentication, and role-based access control.
-
Service and Data Protection
Mutual TLS between services, with short-lived certificates from your Vault, and field-level encryption for personal data.
AutoCEN, answered.
-
What is AutoCEN?
AutoCEN is a financial-crime compliance platform that runs inside your infrastructure. It covers fiat and crypto monitoring, sanctions screening, KYC, KYB and counterparty due diligence, risk tiering, case management, and SAR and CTR filing.
-
Does AI make compliance decisions in AutoCEN?
No. Deterministic rules act and people approve. SAR narrative drafts come from a deterministic template, an officer reviews every draft, and no outside AI service is called.
-
Which sanctions lists does AutoCEN screen against?
OFAC SDN, OFAC Consolidated, UN, EU, and UK lists, synced on a schedule, as often as every six hours for OFAC.
-
Does AutoCEN file SARs automatically?
No. Rules can open a SAR case, but every SAR moves through draft, pending review, approved, submitted, and acknowledged, with a second approver required.
-
Can AutoCEN run air-gapped?
Yes. It runs without outside connectivity. In an air-gapped site you supply sanctions and reference-data updates through your own transfer process.
See it inside your environment.
Live AutoCEN walkthroughs in your environment are available under NDA. Request a briefing to see the analyst dashboard, sanctions-screening flow, and case-management workflow running against representative data.