Case actions are timestamped and attributed to the user who took them.
Scheduled monitoring
Typologies run on the schedules you set; every run shows on the AML Dashboard.
One platform, full lifecycle
From screening to STR filing, without switching tools.
Configurable by design
Weightages, alert bands and typologies tuned to your own risk policy.
Platform overview
What Fyscal ARCX does
One platform for the anti-money-laundering lifecycle, from data ingestion to STR filing.
Screen with confidence
Match customers against watchlist entries with configurable field weightages: Watchlist Search and Manual Screening for one-off checks, Batch and Delta Screening for scheduled runs.
Monitor every transaction
Build variables and typologies for patterns such as structuring and unusual transfer volumes, test them in Shadow mode, and send them for activation.
Investigate, don't just detect
Every alert can be grouped into a case, disposed with a rationale, and, where needed, reported through a filed STR.
Triage by queue
My Queue shows the alerts assigned to you; All Alerts shows every alert, filterable by module, score, status and SLA.
One case, one audit trail
Alerts added, dispositions, notes, reviews and reopens are recorded on the case's Activity Timeline.
AI-assisted review
Case Copilot and the alert AI Summary summarise what is already on the record; the analyst makes and records every decision.
How the work flows
The AML lifecycle, in four steps.
What your team does in Fyscal ARCX, from the first record loaded to the filed report.
01 / 04
Prepare
Batch Ingestion loads customers, accounts and transactions on a schedule. Customer 360 keeps one profile per customer.
Sign in with the platform address and credentials your administrator gives you, then start from the AML Dashboard. About Fyscal ARCX
Log in
Your platform URL, your credentials, verified with an OTP step.
Open the AML Dashboard
Pending alerts and cases, case distribution and daily job health at a glance.
Screen or monitor
Run a screening check or watch alerts arrive from active rules.
Investigate and resolve
Turn a confirmed hit into a case, and close it with a clear disposition.
What's new
Latest releases
NewCustomer Risk Profile (CRP)Risk Score Configuration and Score Configuration under Customers: choose the customer attributes to score, give each value a score from 0 to 100, weight the attributes up to 100% in total, set the Low, Medium and High score bands, and activate versions from a draft, with a full configuration history. Each customer's score and its breakdown appear on the new Customer Risk Score tab of the Customer Profile.
NewTypology LibraryFifteen example typologies built in Transaction Monitoring, each with its variables and conditions, a dry-run result and a Shadow activation request, plus how to test a rule with Dry Run and request Shadow activation through Maker Checker Approval.
NewAML DashboardSix metric tiles (Overdue, Unassigned, Escalated and Pending alerts; Pending and Escalated cases), case and alert distribution by status, disposition, score, type, assignment and age, an STR Filed chart, and a Daily Jobs grid for Batch Screening, Delta Screening, TM Runs and Data Ingestion.
Fyscal ARCX is the anti-money laundering (AML) platform from Fyscal Technologies. Compliance teams use it to screen customers against watchlists, monitor transactions, investigate the resulting alerts and cases, and file Suspicious Transaction Reports (STRs). Read this chapter before you start: it shows how to sign in, move between modules, check your notifications, manage your own account, and find the chapter for the task you want to do.
For
Everyone: analysts, supervisors and administrators
Fyscal ARCX takes in customer, account, transaction and watchlist data, checks it, and raises alerts. Analysts work the alerts, group them into cases, record a decision and, where a case calls for it, file an STR. Diagram 1.1 shows this main path. Diagram 1.2 shows the approval lane that some changes, such as activating a typology, go through before they take effect.
Data inBatch Ingestion and Watchlist Ingestion
Screening and monitoringName Screening runs and scheduled typologies
AlertsCase Manager → Alerts
CasesAlerts merged per customer, or grouped by an analyst
DecisionDispositions, Pending Review, Closed
STRFiled from a case; listed in STR Listing
Diagram 1.1 — The main path: from data to alerts, cases and STRs
Data in.Batch Ingestion imports Customers, Accounts and Transactions files on a schedule. Watchlist Ingestion lists the watchlist files from LSEG and the Internal Watchlist.
Screening and monitoring. Name Screening compares customers with the watchlists; each Batch Screening and Delta Screening run shows the Alerts Created. Transaction Monitoring runs typologies (rules) on schedules against the transaction data.
Alerts. Both modules raise alerts into Case Manager → Alerts: Name Screening alert IDs start ALT-NS, Transaction Monitoring alert IDs ALT-TMS.
Cases.Case Creation & Assignment merges alerts into cases ("based on customer ID, case age, and status", as its banner states) and assigns them. An analyst can also use Group into Case on an alert or Add Alerts on a case. Customer 360 and Watchlist Search support the investigation.
STR. From a case, File STR opens the six-step STR wizard (File an STR). Cases with an STR show the status STR Draft or STR Created, and a filed report appears in STR Listing.
Maker submits a requestFor example Activate Typology, with a Reason
Ticket raisedMaker Checker Approval → Tickets, status Pending
Checker actsThe change "will be applied once approved"
Diagram 1.2 — The approval side lane: changes that need a second person
The approval lane sits beside the main path. When you activate a typology, Fyscal ARCX asks for a Reason and confirms "Submitted for governance review (ticket …). It will be applied once approved." The typology stays Draft while the request waits (see Request Shadow activation). In Shadow Mode its alerts are shown on the rule's page; in Published Mode they "flow into Alert Manager". The activities that need approval, and their rules, are listed in Configs; the requests are in Tickets.
Each path below lists the sections to read first for one kind of work, in the order you are likely to need them. If you are new to the platform, read How Fyscal ARCX fits together first. Your administrator decides what you can access, so some screens or buttons in a path may not be available to you (see Roles).
Use the sign-in page to open Fyscal ARCX with your account email and password. It is titled Welcome back, with the instruction Enter your email and password to access your account. It has two fields, Email and Password, a Sign in button and a Forgot password? button.
Figure 1.1 The sign-in page: Email (1), Password (2) with the eye icon (3), Sign in (4) and Forgot password? (5)
Field or control
What it expects or does
Email (1)
The email address of your Fyscal ARCX account. The placeholder reads m@example.com.
Password (2)
Your password. The eye icon (3) at the right of the field shows or hides the characters you type.
Sign in (4)
Submits your email and password.
Forgot password? (5)
Use it if you cannot sign in with your current password.
Step 1Open the platform
Go to the Fyscal ARCX URL your institution has given you. The Welcome back page opens.
Step 2Enter your email
Type your account email address in Email.
Step 3Enter your password
Type your password in Password. Click the eye icon if you want to check what you typed.
Step 4Sign in
Click Sign in. If you cannot sign in, click Forgot password?.
Use the sidebar to move between modules; this section shows where each menu leads. The Homepage shows Welcome followed by your name. Every module is opened from the sidebar on the left. The sidebar groups its menus under Platform; menus with a chevron (›) expand to show their pages, and the page you are on is highlighted.
Figure 1.2 The sidebar with Fyscal ARCX and Case Manager expanded (1 to 6), and the Activity panel open (7)
Activity (inbox icon): opens the Activity notifications panel. See Activity notifications.
Toggle Sidebar: collapses the sidebar to a narrow rail, or expands it again.
Homepage: returns to the welcome page.
Fyscal ARCX: the AML modules described in this guide.
Case Manager, expanded to show Cases, Alerts and Config.
Each page shows its title at the top with a breadcrumb beneath it, for example Fyscal ARCX › AML Dashboard. Your name and email are shown at the bottom of the sidebar; click them to open the user menu.
The Activity panel lists notifications you receive while signed in. It opens over the current page, so you can check it from any screen (Figure 1.2, area 7).
Control
What it does
Enable notifications (bell icon and switch)
Turns notifications on or off. The switch is off in Figure 1.2.
All
Tab showing every notification.
Unread (0)
Tab showing unread notifications; the number in brackets is the unread count.
Mark all read
Marks every notification as read.
When there is nothing to show, the panel reads No activity yet: Notifications you receive while signed in will show up here.
Step 1Open the Activity panel
Click the inbox icon at the top of the sidebar, next to the Fyscal Technologies logo. The Activity panel opens on the All tab.
Open the user menu when you want to change your password or log out. The block at the bottom of the sidebar shows your initials, name and email address (the email is partly masked). Click it to open the user menu, which repeats your name and email and offers two actions.
Figure 1.3 The user menu: your name and email (1, hidden in the figure), Change Password (2) and Log out (3)
Your name and email (1): the block at the bottom of the sidebar that opens the menu.
Follow these steps when you want to replace your current password. Before you can set a new password, the Verify Your Account page asks you to confirm who you are: Enter your email and current password to continue with the password change process.
Figure 1.4 Change Password, Verify Your Account: Email (1), Password (2) with the eye icon (3) and Continue to Password Change (4)
Field or control
What it expects or does
Email (1)
Placeholder Enter your registered email: the email address of your account.
Password (2)
Placeholder Enter your current password. The eye icon (3) shows or hides the characters.
Continue to Password Change (4)
Verifies your email and current password and continues the password change. The button is greyed out while the fields are empty.
Step 1Open the user menu
Click your name at the bottom of the sidebar.
Step 2Choose Change Password
Click Change Password. The Verify Your Account page opens.
Step 3Verify your account
Enter your registered email in Email and your current password in Password.
Step 4Continue
Click Continue to Password Change and follow the on-screen instructions to set your new password.
Read this section if a picker or button you see in the guide looks different for you. Roles are defined per hierarchy in Case Manager → Config → Team Management. The AML hierarchy there has four levels: AML Admin, AML Team Lead, AML Supervisor and AML Analyst.
Some pickers and actions depend on the permissions of the signed-in user. For example, the list of people you can choose in an assignee picker, and whether a button is available to you, can differ from one user to another.
The AML Dashboard gives a single view of the alert and case workload. Analysts and reviewers use it to see how many alerts and cases are overdue, unassigned, escalated or pending, and how they are distributed by status, disposition, score, type, assignment and age. It also shows STRs filed over time and whether each day's screening, monitoring and ingestion jobs succeeded.
For
Analysts, supervisors and team leads
In the menu
Fyscal ARCX → AML Dashboard
Reading time
About 12 min
Dashboard layout: find each area of the page and see which charts each view shows.
Metric tiles: check the headline counts of overdue, unassigned, escalated and pending work.
Use this overview to find each area of the dashboard before you read a chart. Open Fyscal ARCX in the sidebar and click AML Dashboard. The page is titled AML Dashboard, with the breadcrumb Fyscal ARCX › AML Dashboard. Scroll down to see every area. Figure 2.1 shows the whole page in the Cases view with the range set to 6M (18 Apr - 14 Oct).
Figure 2.1 The AML Dashboard in the Cases view, with its areas numbered 1 to 10
Metric tiles: six headline counts for alerts and cases. See Metric tiles.
Case Distribution header and controls: View Details, the Cases / Alerts switch, the date range picker and the range presets. See Case Distribution controls.
Areas 3 to 8 sit inside the distribution panel and change with the Cases / Alerts switch. In the Alerts view the panel is titled Alert Distribution and shows these charts, in order:
Chart or tile
Cases view
Alerts view
By Status
Yes
Yes
By Disposition (Closed)
Yes
Yes
By Score
No
Yes
By Type
No
Yes
By Assignment
Yes
Yes
STR Filed
Yes
No
By Age
Yes (case age buckets)
Yes (alert age buckets)
Pending Review, Avg. Handling, Reopens
Yes
No
The metric tiles, Daily Jobs and Team Performance appear in both views.
Use the metric tiles for a quick count of the alerts and cases that are overdue, unassigned, escalated or pending. Six tiles at the top of the page each show a label, a count and a sub-label. The Overdue Alerts count is shown in red.
The tiles are counts only. To work the alerts or cases behind a tile, open the list in Case Manager. The table shows where each count can be found again. In the captures, the chip counts on the All Alerts and All Cases tabs matched the tiles.
Tile
Where to work it
Matching count in the captures
Overdue Alerts
Case Manager → Alerts → All Alerts. Click Show Filters and set SLA to Breached (Alerts list).
Chip SLA Breached 173346 = tile 173,346
Unassigned Alerts
Case Manager → Alerts → All Alerts. The Unassigned chip shows the count (Alerts list).
Chip Unassigned 153888, tile 153,865 (the two counts differ)
Escalated Alerts
Case Manager → Alerts → All Alerts. Set Status to Escalated.
Chip Escalated 87 = tile 87
Pending Alerts
Case Manager → Alerts → All Alerts. Set Status to Pending Review.
Use these controls before reading the charts below: they set whether the charts count cases or alerts, and over which period. The distribution panel has its own header and controls.
Figure 2.3 Case Distribution controls: View Details (1), the Cases / Alerts switch (2), the date range (3) and the range presets (4)
View Details: in the Cases view, opens the Cases list in Case Manager.
Cases / Alerts: switches the panel between cases (Case Distribution) and alerts (Alert Distribution). The selected option is shown in white.
Date range picker: shows the period the charts cover, for example 18 Apr - 14 Oct, with a calendar icon at the right. When the page was opened for these captures, it showed 8 Oct - 14 Oct.
Range presets: Today, 7D, 30D, 3M, 6M and 1Y. The selected preset is shown in black; in Figure 2.3 it is 6M, which sets the range to 18 Apr - 14 Oct.
Step 1Choose cases or alerts
Click Cases or Alerts. The panel title changes to Case Distribution or Alert Distribution and the charts redraw.
Step 2Set the period
Click a preset such as 30D. The date range picker updates to show the new period.
Step 3Open the underlying list
In the Cases view, click View Details to open the Cases list.
Use By Status to see how cases or alerts are spread across statuses. It is a donut chart with a legend that gives, for each status, the count and its share of the total in brackets.
Figure 2.4 By Status in the Cases view, range 6MFigure 2.5 Alert Distribution: the switch on Alerts (1), the range set to 6M (2) and By Status
Use this chart to see how closed cases or alerts were dispositioned. It is a donut chart of closed records by disposition: True Match, False Match and Potential Match, each with its count and share.
Figure 2.6 By Disposition (Closed) in the Cases view, range 6M
Use these charts to break alerts down by score band and by alert type. They appear only in the Alerts view, between By Disposition (Closed) and By Assignment.
Figure 2.7 By Score (1) and By Type (2) in the Alerts view
By Score (1): a donut chart of alerts by score band, High, Medium and Low, each with its count and share. In Figure 2.7: High 3,577 (2.2%), Medium 155,404 (97.8%), Low 0 (0.0%).
By Type (2): a horizontal bar for each alert type, with its count and share at the right. In Figure 2.7: Transaction Monitoring 18,117 (10.2%) and Name Screening 158,981 (89.8%).
Use By Assignment to see how many records are unassigned and how the rest are spread across assignees. It is a horizontal bar chart of records by assignee. The first bar is Unassigned (1); the other bars are named users. Names are hidden in this guide.
Figure 2.8 By Assignment: the Unassigned bar (1) and the Team / Individual switch (2); user names hidden
The Team / Individual switch (2) at the top right changes the grouping. Team is selected (shown in black) in Figure 2.8. The horizontal axis scale follows the counts; in Figure 2.8 it runs from 0 to 80K.
Use STR Filed to follow the number of STRs filed per month. It is shown in the Cases view only: a line chart of STRs filed per month, with its own range presets Today, 7D, 30D, 1M, 6M and 1Y at the top right (2). The title carries a link icon (1). In Figure 2.9 the 6M preset is selected and the chart runs from Apr '26 to Sep.
Figure 2.9 STR Filed: the link icon (1) and its own range presets, with 6M selected (2)
For the filed reports themselves, see STR Listing.
Use By Age to see how many records fall in each age bucket. It is a horizontal bar chart of records by age bucket. The buckets differ between the two views:
View
Age buckets
Cases
0-3d, 4-7d, 8-14d, 15-30d, 30+ days
Alerts
0-24h, 1-3d, 4-7d, 8-14d, 14+ days
Figure 2.10 By Age (1), followed by the Pending Review (2), Avg. Handling (3) and Reopens (4) tiles (Cases view)
Use these tiles for three summary figures on cases: how many are pending review, the average handling time and the number of reopens. In the Cases view, three tiles close the distribution panel (Figure 2.10):
Check Daily Jobs to see, day by day, whether the screening, monitoring and ingestion jobs ran and succeeded. It shows the outcome of the platform's scheduled jobs. It has two blocks: Screening & Monitoring Runs and Data Ingestion.
Figure 2.11 Daily Jobs: Screening & Monitoring Runs (1) and Data Ingestion (2), from 14 Oct back to 8 Oct
Both blocks are grids with one row per job and one column per day, newest first. The day columns in Figure 2.11 run from 14 Oct back to 8 Oct. The first column, Job, shows the job name as a link (shown in blue) to the screen where the job is managed.
Each day cell shows a coloured dot for the outcome of that job on that day. When the job ran, the dot is followed by a figure in brackets, in most cells with a multiplier before it (for example x2 (0)).
Look here for analyst productivity, supervisor reviews and assignment analysis. The last panel on the page is Team Performance, described as Analyst productivity, supervisor reviews, assignment analysis, with a See Team Performance button at the right.
Figure 2.12 The Team Performance panel and the See Team Performance button (1)
Use this routine to go from the dashboard counts to the lists where the work is done. It uses only the tiles, chips and filters described in this guide. Adapt the order to your team's procedures.
Who
Supervisors and team leads; analysts for their own queue
Where
AML Dashboard, then Case Manager → Alerts and Cases
Output
The day's backlog listed and the job runs checked
Step 1Read the tiles
Open Fyscal ARCX → AML Dashboard. Note the counts on Overdue Alerts, Escalated Alerts, Pending Cases and Escalated Cases (Metric tiles).
Step 2List the overdue alerts
Open Case Manager → Alerts and click All Alerts. Click Show Filters and set SLA to Breached. To work one module at a time, also set Module to Name Screening or Transaction Monitoring (Alerts list).
Step 3List the escalated alerts
On the same tab, set SLA back to All SLAs and Status to Escalated.
Step 4Review the cases waiting for you
Open Case Manager → Cases, click All Cases, then click the Pending Approval chip. The list shows the cases in Pending Review. Open each case and act on it as in Review a case in Pending Review. For escalated cases, click Show Filters and set Status to Escalated.
Step 5Check that the daily jobs ran
Back on the dashboard, scroll to Daily Jobs. For Batch Screening, Delta Screening and TM Runs, look at the latest day columns: green marks Succeeded, red Failed, orange Mixed outcomes or In progress, and grey No status (Daily Jobs). In the Data Ingestion block, check the Customers, Accounts, Transactions and Watchlist rows the same way.
Case Manager is where analysts and reviewers work the alerts raised by Name Screening and Transaction Monitoring, group them into cases, record dispositions and prepare Suspicious Transaction Reports (STRs). The menu has three items: Cases, Alerts and Config. This chapter covers Cases and Alerts; Config is described in Case Manager Config.
For
Analysts, supervisors and team leads
In the menu
Fyscal ARCX → Case Manager
Reading time
About 50 min
The sections below follow the Case Manager menu (Cases, then Alerts). To follow an investigation from start to finish, read them in this order:
Alert raisedName Screening or Transaction Monitoring, listed under Alerts
Grouped into a caseAutomatically, or with Add Alerts or Group into Case
InvestigateMatches or evidence tabs, Timeline & Notes, Case Copilot
DecideDispose Alert for each alert, then the case Disposition
File STRSix-step wizard; the STR is listed in STR Listing
Diagram 3.1 — From alert to STR in Case Manager
An alert is raised by Name Screening or Transaction Monitoring and appears under Alerts. Alerts are merged into cases automatically, as set in Case Creation & Assignment (Case Manager Config), or by hand with Add Alerts on a case or Group into Case on an alert. On the case you review the evidence, record a disposition for each alert and for the case, and, where the activity is suspicious, file a Suspicious Transaction Report (STR) from the case. A filed STR is listed in STR Listing.
The Cases screen lists cases in two tabs. My Queue shows the cases assigned to you. All Cases shows every case you can see, with summary chips above the list. Each tab shows its count (in the example, My Queue 4 and All Cases 73.1K).
Figure 3.1 The Cases screen on the All Cases tab, with the summary chips, search and the case list
My Queue and All Cases tabs, each with a count.
Summary chips (All Cases only): Unassigned, Escalated, Pending Approval and Active Agents, each with a count. Clicking Pending Approval filters the list to cases in Pending Review (see Filter and search cases).
Search box: Search by Case Title / ID or Customer Name.
Refresh reloads the list. Show Filters opens the filter bar (the button then reads Hide Filters).
The case list. On All Cases, each row and the header have a checkbox.
Pagination: Showing 1-10 of 73127 on the left; Page 1 of 7313 with first, previous, next and last page buttons on the right.
Column
What it shows
Case Title / ID
The case title (the customer name or, for some cases, an alert ID) and the case ID, for example CASE-2026-0034617, with a copy icon.
The filter bar narrows the current tab. Filters combine with each other and with the search box.
Filter
Default
Options
Status
All Statuses
All Statuses, Not Started, Under Investigation, Pending Review, Escalated, STR Draft, STR Created, Closed, Reopened
Creation Period
Pick a date range
A two-month calendar for choosing a start and end date
Age Period
Any Age
Any Age, Less than a day, 1 to 3 days, 3 to 7 days, 7 to 30 days, More than 30 days
Case Origin
All Origins
All Origins, Manual, Automated
Assignee
All Assignees
A list of users. The signed-in user is labelled (You).
Step 1Open the filter bar
Click Show Filters. The Status, Creation Period, Age Period, Case Origin and Assignee filters appear below the search box.
Step 2Filter by status
Open Status and choose one status. The current choice is ticked.
Figure 3.2 The Status filter open, with its nine options; the current choice is ticked
Step 3Filter by creation date
Click Creation Period. A calendar showing two months opens; use the arrows to move between months, then click the first and last day of the range.
Figure 3.3 The Creation Period calendar
Step 4Filter by age or origin
Open Age Period to choose how long cases have been open, or Case Origin to show only Manual or Automated cases.
Figure 3.4 The Age Period filterFigure 3.5 The Case Origin filter
Step 5Use a summary chip
On All Cases, click the Pending Approval chip (1). The Status filter is set to Pending Review (2), an active-filter tag Status: Pending Review appears with an × to remove it (3), RESET FILTERS appears beside it (4), and the All Cases count changes to the filtered total, 13 in the example (5).
Figure 3.6 All Cases after clicking Pending Approval (1): the Status filter (2), the active-filter tag (3), RESET FILTERS (4) and the filtered count (5)
Step 6Clear the filters
Click × on an active-filter tag to remove that filter, or click RESET FILTERS to remove them all.
These are the values offered by the Status filter and the case Disposition dropdown, with what the case screen shows for each.
Status
What the screen shows
Not Started
Offered by the Status filter. No case in this status was captured for this guide.
Under Investigation
Offered by the Status filter, and one of the Case Status values of the case-creation group in Case Creation & Assignment. No case in this status was captured for this guide.
Pending Review
A disposition is waiting for a reviewer. The case shows the Pending Review panel with Review Decision, Reject and Approve (see Review a case in Pending Review). Counted by the Pending Approval chip.
Escalated
Counted by the Escalated chip. The escalated example case shows Add Alerts, with Disposition (Select Outcome) and Dispose Alert greyed out (Figure 3.7).
STR Draft
The case bar shows Preview STR and ReOpen.
STR Created
The case bar shows Download STR and ReOpen.
Closed
The case bar shows the decision (Rationale Code, Details, Decided On, Decided By). The example Closed case, with disposition True Match, shows File STR and ReOpen.
Reopened
A closed case that has been reopened. Its timeline records a Reopened event with previous_status: closed. The reopened example case (Figure 3.8) shows Add Alerts, the alert strip and Dispose Alert, and Disposition reads Select Outcome.
What the case bar shows in each status
The buttons in the case bar change with the status. The table records what each example case shows; a status with no captured example is left out. Yes: shown; Partial: shown greyed out; No: not shown.
Figure 3.7 An Escalated case (CASE-2026-0107633): the Escalated status (1), Disposition greyed out (2), Add Alerts (3) and Dispose Alert greyed out (4)
Status changes recorded on screen
Closed
ReOpen
Reopened
Disposition Submitted
Closed
Diagram 3.2 — Case status changes recorded in a case timeline
The timeline of CASE-2026-0034617 records both changes. ReOpen on a Closed case gives the status Reopened, and the Reopened event shows previous_status: closed. On the reopened case, a Disposition Submitted event tagged Case closed closes it again; the next Reopened event again shows previous_status: closed. The STR statuses are covered in File an STR.
Disposition
Where it appears
True Match
The case Disposition dropdown, the alert Disposition dropdown and the Dispose Alert dialog. Before a disposition is chosen, the case dropdown reads Select Outcome and the alert dropdown Select outcome; list columns show -.
Case Details shows one case: its status and owner, the alerts it contains, the customer, and the evidence behind each alert. The example is CASE-2026-0034617 for the customer Pooja Sharma, with six Name Screening alerts.
Figure 3.8 Top of Case Details for CASE-2026-0034617
Header: Case Details, the case ID (with a copy icon), the case age (60 Days in the example), the number of alerts (6 Alerts) and the creation date and time, with the breadcrumb Fyscal ARCX › Cases › CASE-2026-0034617. At the right are Timeline & Notes (see Timeline and notes) and Case Copilot (see Case Copilot).
Case bar: Status, Assigned To (a dropdown of users) and Disposition (a dropdown with True Match, False Match and Potential Match).
Alert strip: one tab per alert, showing the module (NS for Name Screening, TM for Transaction Monitoring), the alert ID, the customer name, the alert's disposition once recorded, and the score band with its percentage. The selected tab is underlined in blue and the rest of the page shows that alert. When there are more tabs than fit, the strip continues to the right.
Accounts, with the number of accounts in brackets.
Below the customer card, a Name Screening alert shows Matches; a Transaction Monitoring alert shows the tabs Analytics, Transactions, Other Cases / Alerts and Rule Analysis (see Transaction Monitoring evidence tabs). The buttons in the case bar change with the status: see the table in Case statuses and dispositions.
The customer card identifies the customer behind the selected alert. For the full customer profile, see Customer 360.
Area
What it shows
Card header
Customer name and customer ID (with a copy icon), then tags: TYPE (for example INDIVIDUAL, CORPORATE), SEGMENT, RISK (band and score, for example HIGH (93)), KYC, STATUS, COUNTRY and PEP Flag.
Tiles
DECLARED INCOME, EXPECTED MONTHLY SPEND, SOURCE OF FUNDS and ONBOARDING (date, time and channel, for example via BRANCH). A tile is left out when the value is missing.
More / Less
More expands three panels and changes to Less: BUSINESS & EMPLOYMENT (Designation, Employer, Segment, Source of Funds, Country of Operations), FINANCIAL INFORMATION (Declared Income, Expected Monthly Spend, Purpose, Onboarding Channel, Expected Txn Frequency) and Additioanl Details (City, Country, Sanctions).
Accounts (n)
One row per account: account number, account type (for example CURRENT), bank and status (for example ACTIVE, FROZEN, CLOSED). The arrow at the right expands the row to show Type, Bank, Holding, Currency, Bank Country and Opened.
Figure 3.9 The customer card expanded: Less (1), BUSINESS & EMPLOYMENT (2), FINANCIAL INFORMATION (3) and Additioanl Details (4)Figure 3.10 An account row expanded: Type, Bank, Holding, Currency, Bank Country and Opened
Matches (Name Screening alerts)
Matches compares the customer with each watchlist candidate found for the selected alert. The red tag gives the number of candidates (Matches: 1).
The grey left column (1) lists the customer's own values for Name, Nationality, Date of Birth, Address and Entity Type, under the row labels Match Score and UID (watchlist).
Each candidate column (2) shows the score band and percentage (for example LOW 87.94%), the watchlist category (for example INDIVIDUAL), the watchlist UID, and for each field the watchlist value with its Weightage and Score.
The candidate with the blue border is the one shown in the panel below (3), headed Selected: with the candidate's name, band, UID, Screening number and Category.
Figure 3.11 Matches for CASE-2026-0034617: the customer column (1), one watchlist candidate (2) and the Selected panel (3) on the Identity tab (4)
The Selected panel has two tabs (4):
Tab
Sections and fields
Identity
IDENTITY SUMMARY: Entity Type, Date of Birth, Place of Birth, Nationality, Citizenship, Address, Deceased. KNOWN ALIASES & SPELLINGS: Primary Aliases. Missing values read Not Provided, Unknown or —.
Additional Information
LIST CLASSIFICATION: Category, Sub-Category. ASSOCIATES: watchlist UIDs of associated entries. FURTHER INFORMATION: BIOGRAPHY, IDENTIFICATION, REPORTS. LIST METADATA: List Entry Date, Last Updated. KEYWORDS & SOURCES: External Sources, with the number of sources and a link for each.
Figure 3.12 The Additional Information tab: LIST CLASSIFICATION (1), ASSOCIATES (2), FURTHER INFORMATION (3), LIST METADATA (4) and KEYWORDS & SOURCES (5)
When the selected alert is a Transaction Monitoring (TM) alert, four tabs appear below the customer card. The same tabs appear on a Transaction Monitoring alert in Alert Details.
Tab
What it shows
Analytics
For the customer, period buttons 1D, 7D, 30D, All and an Alert Window checkbox. INCOMING and OUTGOING each give, per currency, TOTAL (with the number of transactions and senders or recipients), AVG and MAX (with the transaction ID). Below: Top Counterparties by Amount and Transaction Types, five of each, with buttons such as 14 more Counterparties and 4 more Types.
Transactions (n)
Transaction Pattern with Transaction Trends and Volume Heatmap views, a date range, Day, Week and Month, and the charts Transaction Volume and Transaction Count. Transaction Table with the filters All Types, All Channels, Price range, Pick a date range, Sender ID, Receiver ID and the Triggered Txns checkbox, and the columns Txn ID, Sender, Receiver, Amount, Type, Channel, Date. Each row has an arrow at the right to expand it. Export CSV sits at the top right.
Other Cases / Alerts
A Cases / Alerts switch, each with a count. Cases uses the case-list columns with Status and Date Range filters; Alerts uses the alert-list columns with Status, Disposition and Date Range filters.
Rule Analysis
RULE TRIGGERED: the rule name with a tag (for example internal), the Window start and frequency (for example every 1 Month), the number of breaches, and each breached condition (for example transactions.amount > 10000) tagged Breach.
Figure 3.13 Analytics tab for CASE-2026-0034611 (Rafael Serrano Dimaculangan): the evidence tabs (1), period buttons and Alert Window (2), INCOMING (3) and OUTGOING (4) totals per currency, Top Counterparties by Amount (5) and Transaction Types (6)Figure 3.14 Transactions tab with the Month view: the evidence tabs (1), Export CSV (2), Transaction Trends and Volume Heatmap (3), Day, Week, Month and the date range (4), the table filters (5), Triggered Txns (6) and the table columns (7)Figure 3.15 Other Cases / Alerts tab: the Cases and Alerts switch with counts (1) and the Status and Date Range filters (2)Figure 3.16 Rule Analysis tab: rule H_V_T with its tag and window (1), the breach count (2) and the breached condition transactions.amount > 10000 (3)
Timeline & Notes opens the Activity Timeline panel on the right, headed with the case ID. It holds the case notes and a dated log of what happened to the case, newest first.
Figure 3.17 Activity Timeline for CASE-2026-0034617: the note box (1), Attach File (2), Add note, greyed out while the box is empty (3), the newest event (4) and the close button (5)
Step 1Add a note
Type in ADD A NOTE (Add an investigation note...) (1). To attach a document, click Attach File (2). Click Add note (3); it is greyed out while the note box is empty.
Step 2Read the events
Each event (4) shows its type, the user (or System) and the date and time. The events seen on cases are listed below. Click × (5) to close the panel.
Event
Details shown
Created
The first event. Alert Added with the alert and a View alert timeline link.
Linked to Case
Each alert added to the case, with customer name, alert ID, band and score, and View alert timeline.
Disposition Submitted
Tags such as Case closed and the number of alerts, the Rationale code and Rationale. View per-alert dispositions(n) expands to list each alert with its band and score, disposition, rationale code and rationale.
Reopened
previous_status (for example closed), the Rationale, and n alert(s) Reopened with a link to each alert.
Case Copilot (AI Investigation Assistant) is a chat panel that answers questions about the open case. On first use it greets you by first name and asks How can I help you with this case?. Its prompt and model are set in Agentic Workflows (see Case Manager Config).
Figure 3.18 Case Copilot after Summarize case (1): the answer in headed sections (2), the suggested prompts (3), and the new-chat and close icons (4)
Step 1Ask a question
Click Case Copilot, then click one of the prompts under What else would you like to know?: Summarize case, Review customer profile, Check watchlist matches, Explain match scores, Compare alerts, Review timeline, Risk assessment or Draft rationale.
Step 2Read the answer
Each answer appears under the prompt you chose, in headed sections. Summarize case returns CASE OVERVIEW, ALERT SUMMARY, CUSTOMER SNAPSHOT, INVESTIGATION STATUS and RECOMMENDED NEXT STEPS. Explain match scores returns OVERALL SCORE, COMPONENT ANALYSIS, SCORE RELIABILITY and CONCLUSION. Earlier answers stay in the panel.
Step 3Start again or close
The icon at the top right starts a new chat; × closes the panel.
Add Alerts to Case lists alerts that are not yet in a case (Select ungrouped alerts to merge into the case ID).
Figure 3.19 The Add Alerts to Case dialog with nothing selected: search (1), an ungrouped alert (2), the counter and paging (3), Cancel and Add alerts (4)
Step 1Find the alerts
Click Add Alerts. Search with Search by customer name or Alert ID, or page through the list with Prev and Next (the page indicator reads, for example, 1 / 6738). Each row shows the customer name, status, date and time, alert number (for example #174489), score band and module.
Step 2Select and add
Tick the alerts to add. The counter at the bottom shows how many are selected out of the total (0 selected · 68810 total in the example). Click Add alerts, or Cancel to close without changes.
Which alerts are grouped into cases automatically is set in Case Creation & Assignment (see Case Manager Config).
Complete the fields in the table below, then click Submit Decision. Cancel closes the dialog without saving. Repeat for each alert in the case.
Field
What it expects
Required
Options or format
DISPOSITION
The outcome for this alert
Yes
True Match, False Match, Potential Match
Rationale Code
The coded reason for the outcome
Yes
A dropdown. It reads Select disposition first until a disposition is chosen. Example code: Identification number of the user is the same as the watchlist.
Rationale Details
Your explanation (Explain your rationale)
Yes
Minimum 10 Characters
Supporting Documents
Files that support the decision
No
Attach File
Step 4Set the case disposition
In the case bar, open Disposition (Select Outcome) and choose True Match, False Match or Potential Match.
Figure 3.21 The case Disposition list open on a Reopened case: True Match, False Match and Potential Match
A closed case shows Status Closed, the chosen Disposition, and a decision block with Rationale Code, Details, Decided On and Decided By. Each alert tab shows its own disposition. The timeline records a Disposition Submitted event tagged Case closed.
Figure 3.22 A Closed case (CASE-2026-0034613): Status Closed (1), Disposition True Match (2), the decision block (3), and File STR and ReOpen (4)
The case timelines show two ways a case has reached Closed:
Path
Timeline events, oldest first
Example
Direct
Disposition Submitted, tagged Case closed and the number of alerts (for example 1 Alert)
CASE-2026-0034611
With review
Review Requested (tagged Case closed, with the disposition True Match and the rationale), then Disposition Approved by a second user (tagged Case closed, 5 Alerts)
CASE-2026-0034613
In both paths the closing event names all of the case's alerts, so the case disposition closes the case together with its alerts.
Cases in Closed, STR Draft and STR Created show ReOpen in the case bar.
Figure 3.24 The Reopen Case dialog: Alert To Reopen with all disposed alerts pre-selected (1), Reason for reopening (2), Supporting Documents (3), Cancel and Reopen (4)
Step 1Choose the alerts
Click ReOpen. The Reopen Case dialog lists the case's alerts under Alert To Reopen, each with its disposition. All disposed alerts are pre-selected. Uncheck any that should remain closed.
Step 2Give the reason
Enter Reason for reopening (required; Provide a rationale for opening this case). Optionally add Supporting Documents with Attach File. Click Reopen, or Cancel.
A reopened case has the status Reopened, and its timeline shows a Reopened event with the previous status, the rationale and the reopened alerts.
The STR wizard, titled Suspicious Transaction Report (STR) with the subtitle GoTRACS-compliant STR filing for AMLC, prepares a Suspicious Transaction Report for the AMLC from a case. It opens over Case Details and shows the case ID in its header. The case bar shows the STR button that matches the case status:
Case status
STR button
What it does
Closed (in the examples, with disposition True Match)
File STR
Opens the wizard to file an STR for the case.
STR Draft
Preview STR
Reopens the saved draft at the step where it was left.
Dispose the case's alerts and close the case first (see Dispose alerts and close a case). File STR appears only once the case is closed: open cases (for example Reopened) show Dispose Alert and the Disposition list instead, and no STR button. In the examples, File STR is shown on a Closed case with the disposition True Match.
After the STR is created, the timeline records an STR Created event and the case bar shows Download STR in place of File STR (CASE-2026-0034611).
You need at least one suspicious transaction for step 4. Select Suspicious Transactions is required, and Next Step stays disabled while no transaction is selected (see Common blocks).
Have the Date of determination ready. On step 2 it sets the Filing deadline message shown next to it.
The six steps
The progress bar across the top of the wizard shows the six steps. The current step has a blue number; a step already completed shows a green tick; later steps show a grey number.
Figure 3.25 The STR wizard for CASE-2026-0107624: the title and case ID (1), steps 1 to 3 completed (2), step 4 Transaction current (3), the later steps (4) and the close button (5)
The title, Suspicious Transaction Report (STR), with GoTRACS-compliant STR filing for AMLC and the case ID.
Steps already completed show a green tick (here steps 1 to 3).
The current step has a blue number (here step 4, Transaction).
Open the wizard from the case: with File STR to start an STR, or with Preview STR to continue a saved draft.
Step 1Start an STR from a closed True Match case
Open the case in Case Details. Check that Status reads Closed and Disposition reads True Match, then click File STR in the case bar.
Figure 3.26 File STR in the case bar of a Closed case with disposition True Match (CASE-2026-0034613)
Step 2Find a case with a saved draft
To continue a draft, go to Cases, open the All Cases tab and type the case ID in Search by Case Title / ID or Customer Name. The case shows the status STR Draft. Click the row to open the case. To list every draft, set the Status filter to STR Draft (see Filter and search cases).
Figure 3.27 All Cases (1) searched for CASE-2026-0107624 (2), with the active-filter tag (3): one case, Bharat Traders LLP, in STR Draft (4)
Step 3Reopen the draft
Click Preview STR in the case bar. The wizard opens at the step where the draft was left. In the example it opens at step 4 Transaction, with steps 1 to 3 ticked (Figure 3.25). Use Previous Step to go back to earlier steps.
Figure 3.28 An STR Draft case (CASE-2026-0107624, Bharat Traders LLP): the STR Draft status (1), Preview STR (2) and ReOpen (3)
Choose which of the case's alerts the STR covers. The screen states: Transactions and parties from selected alerts appear in subsequent steps.
Figure 3.29 Step 1, Select Alerts, for CASE-2026-0107624: the instruction (1), Select all and Deselect all (2), one alert, ALT-159099, selected (3), and the counter (4)
Alerts to include in STR, with the instruction above.
Select all and Deselect all.
An alert row: a checkbox, the alert number (ALT-159099), the alert ID (ALT-NS-17092026-009614) with a copy icon, the customer ID (CUST0111518) and Rule:. A Name Screening alert shows Rule: with no value; a Transaction Monitoring alert shows its rule and its number of transactions (see STR Listing, step 1).
The counter, 1 of 1 Selected.
The footer of step 1, below the list, holds Save as draft and Next Step. Step 1 has no Previous Step.
Field
Code
Required
What to enter or the options
Alerts to include in STR
None shown
No marker
One checkbox per alert in the case. Select all ticks every alert; Deselect all clears them. The counter shows how many are selected out of the total.
Step 1Tick the alerts to report
Tick each alert the STR should cover, or click Select all. Untick any alert to leave out. Check the counter (for example 1 of 1 Selected).
Step 2Go to step 2
Click Next Step. Step 1 now shows a green tick and step 2 Report Type opens.
Choose the type of STR and complete the report header. The values in the figures are those saved in the draft for CASE-2026-0107624.
Figure 3.30 Step 2, Report Type: STR Type (1), Institution code (2), Supervising agency (3), Submission type (4), STR trigger (5), Date of determination (6) and the Filing deadline message (7)
#
Field
Code
Required
What to enter or the options
1
STR Type
None shown
Yes (*)
One of five radio-button cards: STRR - Regular STR, STRA - Per Account, STRHP - High Priority, STRHU - Highly unusual and STRBR - Bulk Report. See STR types compared below.
2
Institution code
H-3
No marker
Greyed out and tagged auto-filled; you do not type it. Help text: 18-digit code assigned by AMLC/BSP. Example: FYSCALTECH20260001.
3
Supervising agency
H-2
Yes (*)
Bangko Sentral ng Pilipinas; Securities and Exchange Commission; Insurance Commission; Designated Non-Financial Businesses and Professions; Philippine Amusement and Gaming Corporation; Cagayan Economic Zone Authority; Aurora Pacific Economic Zone and Freeport; People's Bank Supervised by BSP (Figure 3.31).
A date, dd/mm/yyyy, typed or picked from the calendar icon. Help text: Date the covered person knew or should have known of the suspicious nature of the transaction. Starts the filing deadline clock.
7
Filing deadline
None shown
Not an entry
A message beside the date, worked out from it. It changes with the current date. For 30/09/2026 it read Filing deadline: October 7, 2026 (Due today!) on 7 October and Filing deadline: October 7, 2026 (Overdue by 6 days) on 13 October.
Transaction with no apparent economic purpose or business pattern
Bulk Report (BSIs only, 5 working days)
Described as the default
Yes
No
No
No
No
Linked to an AMLC request or referral
No
Yes
No
No
No
Names specific crimes
No
No
Yes
No
No
Limited to some institutions
No
No
No
No
YesBSIs only
States a time limit
No
No
No
No
Yes5 working days
Step 1Choose the STR type
Under STR Type, click the card that fits the report. The chosen card has a filled radio button and a blue border.
Step 2Check the institution code
Institution code is filled in for you. Check that it is your institution's code.
Step 3Choose the supervising agency
Click Supervising agency and click your institution's supervising agency. The current choice is ticked.
Figure 3.31 The Supervising agency list, with Bangko Sentral ng Pilipinas ticked
Step 4Choose the submission type
Click Submission type and choose New, Edit/Correction, Delete or Test.
Figure 3.32 The Submission type list, with Delete ticked in the example draft
Step 5Choose the STR trigger
Click STR trigger and choose what led to the report.
Figure 3.33 The STR trigger list, with PPP (Public Private Partnership) ticked
Step 6Enter the date of determination
In Date of determination, enter the date as dd/mm/yyyy or pick it from the calendar icon. Read the Filing deadline message that appears beside it (number 7 in Figure 3.30). In the example, 30/09/2026 gives a deadline of October 7, 2026; viewed on 13 October the message reads Filing deadline: October 7, 2026 (Overdue by 6 days), in red.
Step 7Go to step 3
Click Next Step. Step 2 now shows a green tick and step 3 Reason for suspicion opens.
Tick the reason codes that explain why the transactions are suspicious. There are two lists: the required primary codes and optional additional codes. Each list scrolls inside the wizard.
Figure 3.34 Step 3, Reason for suspicion: SC 1 ticked as a primary code and shown dimmed under Additional reason codes
Reason for suspicion codes D-SD-2 (required): Select one or more SC, PC, or MC codes. Multiple selections allowed.
The counter, 1 of 43 Selected. The lists hold 43 codes: SC 1 to SC 6, PC 1 to PC 36 and MC 01.
A ticked code (SC 1 in the example).
Additional reason codes D-SD-5 (optional): Secondary suspicion codes beyond primary codes from Step 3. Codes already selected as primary are shown dimmed.
The same code, dimmed in the additional list because it is already a primary code.
Field
Code
Required
What to enter or the options
Reason for suspicion codes
D-SD-2
Yes (*)
One or more codes, in three groups: Suspicious circumstances — SC1-SC6, Predicate crimes — PC1-PC36 and Transnational organized crime — MC1. See the code table below.
Additional reason codes
D-SD-5
No (labelled (optional))
The same three groups. Codes already ticked as primary are dimmed.
Step 1Tick the primary codes
Under Reason for suspicion codes, scroll the list and tick each code that applies. The counter shows how many are ticked.
Step 2Check KYC REQ on predicate crimes
Scroll to Predicate crimes — PC1-PC36. Most predicate-crime codes carry a yellow KYC REQ tag at the right; PC 4, PC 5, PC 13 and PC 35 do not.
Figure 3.35 Predicate crimes PC 6 to PC 9, each with a KYC REQ tag
Step 3Add MC 01 where it applies
At the end of the list, Transnational organized crime — MC1 holds one code, MC 01: Transnational Organized Crime (used with another predicate crime).
Figure 3.36 The end of the primary list: PC 34 to PC 36 and MC 01
Step 4Tick any additional codes
Under Additional reason codes, tick any secondary codes. Codes already ticked above are dimmed here.
Step 5Go to step 4
Click Next Step. Step 3 now shows a green tick and step 4 Transaction opens.
Code
Description on screen
KYC REQ tag
SC 1
No underlying legal or trade obligation, purpose or economic justification
No
SC 2
Client not properly identified
No
SC 3
Amount not commensurate with business or financial capacity
No
SC 4
Transaction structured to avoid being reported
No
SC 5
Deviation from client's profile/past transactions
No
SC 6
Transaction similar, analogous or identical to any of the foregoing
No
PC 1
Kidnapping for Ransom
Yes
PC 2
Drug Trafficking and Related Offenses
Yes
PC 3
Graft and Corrupt Practices
Yes
PC 4
Plunder
No
PC 5
Robbery and Extortion
No
PC 6
Jueteng and Masiao
Yes
PC 7
Piracy on the High Seas
Yes
PC 8
Qualified Theft
Yes
PC 9
Swindling (Estafa)
Yes
PC 10
Smuggling
Yes
PC 11
Violations under the Electronic Commerce Act of 2000
Yes
PC 12
Hijacking; Destructive Arson; and Murder
Yes
PC 13
Terrorism and Conspiracy to Commit Terrorism
No
PC 14
Financing of Terrorism
Yes
PC 15
Bribery
Yes
PC 16
Frauds and Illegal Exactions and Transactions
Yes
PC 17
Malversation of Public Funds and Property
Yes
PC 18
Forgeries and Counterfeiting
Yes
PC 19
Violations of Anti-Trafficking in Persons Act of 2003
Yes
PC 20
Violations of Revised Forestry Code of the Philippines
Yes
PC 21
Violations of Fisheries Code of 1998
Yes
PC 22
Violations of Philippine Mining Act of 1995
Yes
PC 23
Violations of Wildlife Resources Conservation and Protection Act
Yes
PC 24
Violation of National Caves and Cave Resources Management and Protection Act
Yes
PC 25
Violation of Anti-Carnapping Act of 2002
Yes
PC 26
Violations of Illegal Possession of Firearms, Ammunition or Explosives
Yes
PC 27
Violation of Anti-Fencing Law
Yes
PC 28
Violation of Migrant Workers and Overseas Filipinos Act of 1995
Yes
PC 29
Violation of Intellectual Property Code
Yes
PC 30
Violation of Anti-Photo and Video Voyeurism Act of 2009
Yes
PC 31
Violation of Anti-OSAEC and Anti-CSAEM Act
Yes
PC 32
Violations of RA 7610, Special Protection of Children Against Abuse
Yes
PC 33
Fraudulent Practices under Securities Regulation Code of 2000
Yes
PC 34
Violation of Strategic Trade Management Act
Yes
PC 35
Violations of National Internal Revenue Code of 1997
No
PC 36
Felonies or offenses of a similar nature punishable under penal laws of other countries
Yes
MC 01
Transnational Organized Crime (used with another predicate crime)
Select the suspicious transactions to include in the STR. The list holds the triggered transactions of the alerts selected in step 1. In the example below, the case's only alert is a Name Screening alert, the list is empty and Next Step is greyed out.
Figure 3.37 Step 4, Transaction, for CASE-2026-0107624: no suspicious transactions found, and Next Step greyed out (9); the numbers follow the list below
Type filter.
Period From and Period To date filters.
Selected: the number of transactions selected.
total amount (D-TD-6): the total of the selected transactions. When they are in different currencies it is labelled Mixed (see STR Listing, step 4).
Select Suspicious Transactions (required): Triggered transactions for this case. All are selected by default - deselect any you want to exclude from the STR. The counter at the right reads, for example, 0 of 0 Selected.
Select all and Deselect all.
The transaction table, with the columns Transaction, Amount, Type, Sender, Receiver, MOT, Product and Date. With no transactions it reads No suspicious transactions found for the selected alerts.
Party Role legend for the letters shown next to each sender and receiver.
Next Step, greyed out while no transaction is selected.
One checkbox per transaction. All are selected by default.
Party Role letter
Meaning
S
Subject of Suspicion
B
Beneficiary
C
Counterparty
T
Transactor
O
Other participant
Step 1Narrow the list if needed
Set Period From and Period To to limit the list to a date range. Type offers only All type.
Figure 3.38 The Type filter open, with its only option, All type
Step 2Choose the transactions
All triggered transactions are selected by default. Untick any transaction to leave out of the STR, or use Select all and Deselect all. Check Selected and total amount (D-TD-6).
Step 3Read the note and go to step 5
Scroll to the bottom of the step. The note reads: MOT, Product Type, Purpose of Remittance, and Transaction Code are sourced from ingested data and included automatically in the Format X CSV per selected transaction. Total amount can be manually overridden below. Click Next Step. It is greyed out while no transaction is selected.
Figure 3.39 The bottom of step 4: the Party Role legend (8), the note on ingested data, and Next Step greyed out (9)
Check the parties named in the STR. The screen states: Auto-derived from selected transactions. Click a row to expand and edit. Each party row shows an AH tag, the name as Last, First (or Last, First, Middle) and the customer ID.
The figure comes from a filed STR (STR 694, CASE-2026-0000075) opened read-only from STR Listing, so its fields appear greyed.
Figure 3.40 Step 5, Subject parties, in a filed STR viewed read-only: the party Sinha, Harish expanded (1), Party role (2), Account holder (3), Entity (4), IDENTITY (5), ID DOCUMENTS (6) and ADDITIONAL DETAILS (7)
The party row (Sinha, Harish). The customer ID (TEM-CUST-10L847) is at the right; the arrow collapses the row.
Party role.
Account holder checkbox, labelled (emits A-block in CSV).
Entity D-A-3.
IDENTITY fields.
ID DOCUMENTS fields.
ADDITIONAL DETAILS fields, further down (scroll the wizard).
Field
Code
Required
What to enter or the options
Party role
None shown
No marker
A list. Example value: S - Subject of Suspicion.
Account holder
None shown
No marker
Checkbox, labelled (emits A-block in CSV).
Entity
D-A-3
No marker
A list. Example value: N - Natural Person.
IDENTITY
Last name
D-A-4a
Yes (*)
The party's last name.
First name
D-A-4b
No marker
The party's first name.
Middle name
D-A-4c
No marker
Placeholder e.g. Salamanca.
CRN
D-A-2
No marker
The customer ID, for example TEM-CUST-10L847.
Account no.
D-A-8
No marker
Placeholder e.g. 1238444223.
ID DOCUMENTS
ID type
D-A-12
No marker
A list. Example value: Others.
ID number
D-A-13
No marker
Placeholder e.g. 045223411.
Date of birth
D-A-4c
No marker
A date (hidden in the figure).
Nationality
D-A-11
No marker
Placeholder e.g. PH.
ADDITIONAL DETAILS
Complete address
D-A-5
No marker
The party's address.
Country code
D-A-6
No marker
Example value: PH - Philippines.
ID City code — PSGC
D-A-7
Labelled Required for PH
The PSGC city code.
Place of birth
D-A-10
No marker
The party's place of birth.
Source of fund
D-A-6
No marker
Example value: Employed.
Contact no.
D-A-15
No marker
The party's contact number.
Old account no.
D-A-16
No marker
A previous account number.
Step 1Expand a party
Click a party row. It expands to show Party role, Account holder, Entity and the IDENTITY, ID DOCUMENTS and ADDITIONAL DETAILS fields.
Step 2Check and complete the fields
Check Party role and Entity, and whether Account holder should be ticked. Make sure Last name is filled in, then complete the other fields you hold for the party. For a party in the Philippines, fill in ID City code — PSGC.
Step 3Repeat for each party and go to step 6
Collapse the row with the arrow at its right and repeat for each party in the list. Then click Next Step.
Write the narrative of the STR. The figure comes from the same filed STR (STR 694) opened read-only from STR Listing, so the text box appears greyed; the narrative text is hidden.
Figure 3.41 Step 6, Narratives, in a filed STR viewed read-only: the STR Narrative, text hidden (1), its counter (2) and the alerts covered (3)
STR Narrative (D-SD-6, required).
The character counter, for example 254 / 4000 — meets GoTRACS recommendation, in green with a tick.
ALERTS COVERED BY THIS STR: the IDs of the alerts selected in step 1, each with a copy icon.
The footer of step 6 holds only Previous Step. This is the last step, so there is no Next Step.
Field
Code
Required
What to enter or the options
STR Narrative
D-SD-6
Yes (*)
Free text. The counter shows the length against a maximum of 4000 characters.
ALERTS COVERED BY THIS STR
None shown
Not an entry
The alerts selected in step 1.
Step 1Write the narrative
Type the narrative in STR Narrative. Watch the counter below the box: it shows the number of characters out of 4000 and reads meets GoTRACS recommendation when the text meets it.
Step 2Check the alerts covered
Read ALERTS COVERED BY THIS STR. If an alert is missing or should not be there, click Previous Step back to step 1 and change the selection.
A case whose STR has been filed has the status STR Created. Its case bar shows Download STR and ReOpen. The filed STR is listed in STR Listing, where you can open it read-only and download its CSV.
Figure 3.42 An STR Created case (CASE-2026-0034611, Rafael Serrano Dimaculangan): the STR Created status (1), Download STR (2) and ReOpen (3)
If you close the wizard with × before the STR is filed, you return to Case Details. A case that already had a saved draft keeps the status STR Draft and its Preview STR button.
Next Step is greyed out on step 4.Select Suspicious Transactions is required. When the alerts selected in step 1 have no transactions, the table reads No suspicious transactions found for the selected alerts., Selected shows 0 and Next Step stays greyed out. No other message is shown. Click Previous Step back to step 1 and check that the selected alerts include ones with transactions; a Transaction Monitoring alert row shows its number of transactions (Figures 3.37 and 3.39).
The filing deadline is shown in red. The Filing deadline message beside Date of determination is shown in red in both examples captured: Filing deadline: October 7, 2026 (Overdue by 6 days) in a draft viewed on 13 October and Filing deadline: August 31, 2026 (Overdue by 44 days) on a filed STR viewed on 14 October (see STR Listing, step 2). On a filed STR the message alone does not show whether the STR was filed late. Check that the date of determination is correct (Figure 3.30).
The Alerts screen lists alerts raised by Name Screening and Transaction Monitoring. My Queue shows the alerts assigned to you; All Alerts shows all alerts, with summary chips and row checkboxes.
Figure 3.43 The Alerts screen on My Queue: the tabs (1), search (2), Refresh and Show Filters (3), the alert list (4) and pagination (5)
My Queue and All Alerts tabs, each with a count (43 and 175.3K in the example).
Search box: Search by Customer Name / ID or Alert ID.
Refresh and Show Filters.
The alert list.
Pagination: Showing 1-10 of 43 and Page 1 of 5 with first, previous, next and last page buttons.
Column
What it shows
Customer Name / Alert ID
The customer name and the alert ID (for example ALT-NS-23092026-008485), with a copy icon. Name Screening IDs start with ALT-NS, Transaction Monitoring IDs with ALT-TMS.
Module
Name Screening or Transaction Monitoring.
Score
The score band and percentage, for example Low 75.76% or Medium 90.79%.
Status
Not Started, Under Investigation, Pending Review, Escalated, Closed or Reopened.
Disposition
True Match, False Match, Potential Match, or -.
SLA Deadline
On Track (green) or Breached (red).
Assigned To
The assigned user, or - when unassigned.
In Case
Yes when the alert belongs to a case, No when it does not.
Created At
Creation date and time.
All Alerts chips and filters
On All Alerts, chips above the list (1) show Unassigned, Escalated, SLA Breached and Active Agents, each with a count. Click Show Filters to open the filter bar (2); the button then reads Hide Filters.
Figure 3.44 All Alerts with the filters shown: the summary chips (1), the filter bar (2), In case (3) and Show Hibernated (4)
Filter
Default
Options
Status
All Statuses
All Statuses, Not Started, Under Investigation, Pending Review, Escalated, Closed, Reopened
Module
All Modules
All Modules, Name Screening, Transaction Monitoring
SLA
All SLAs
All SLAs, Breached, On Track
Score
All Scores
All Scores, Low, Medium, HIGH
Assignee
All Assignees
A list of users. The signed-in user is labelled (You).
Alert Details shows one alert. The example is ALT-NS-05102026-000115 for Ramon Michael Castillo Tan: a Name Screening alert with two watchlist candidates that is assigned but not yet started.
Figure 3.45 Alert Details for a Name Screening alert that is Not Started: the header (1), the alert bar (2), the AI Summary card (3) and the customer card (4)
Header: Alert Details, the alert ID, the score band and percentage (LOW 84.29%), Config: followed by the configuration version ID, and the creation date (shown as - on this alert). At the right: Timeline & Notes and, on this Not Started alert, Start Investigation, shown in grey.
Alert bar: Status, Assigned To (the assigned user, hidden in the figure), Disposition (Select outcome; greyed out on this alert) and SLA Deadline (date and time; red with (Breached) once missed).
Below these, Matches shows each watchlist candidate side by side with the customer (1). Here MICHAEL TAN (2) is selected and RAMON TAN (3) is the second candidate. The highlighted candidate's record opens in the Selected panel (4) with the Identity and Additional Information tabs. All fields are described in Customer, accounts and matches.
Figure 3.46 Matches for ALT-NS-05102026-000115: the customer (1), MICHAEL TAN, LOW 84.29%, selected (2), RAMON TAN, LOW 82.6% (3) and the Selected panel (4)
AI Summary
Until a summary is generated, the card reads No summary yet and Generating reads this alert and its matches, and costs one run against the daily limit. Click Generate summary to create one. The AI Summary control at the top right of the card collapses and expands it. The prompts behind the summary are managed in Agentic Workflows (see Case Manager Config).
A generated summary, as on the Transaction Monitoring alert in Figure 3.48, has:
a verdict tag with a one-line reason (for example Insufficient Data: Insufficient data; transaction details unavailable);
RATIONALE, with a copy icon;
sections with an item count, for example KEY FINDINGS (4), TRANSACTION PATTERN ANALYSIS (3), RULE TRIGGER ANALYSIS (2) and RISKS & DATA GAPS (3);
RECOMMENDED ACTION;
a footer with the prompt version, the model and the generation time, for example Prompt v3 · Model openai/gpt-oss-120b · 28 Sept, 05:28 PM.
Alert timeline
Timeline & Notes opens the Activity Timeline for the alert, headed with the alert number. It has the same ADD A NOTE, Attach File and Add note controls as the case timeline (1). Events are listed newest first, each with its date and time:
Assigned (2): who made the change, and the owner before and after it (here Unassigned » the new owner).
Created (3): an alert raised by screening starts with a Created event by System.
Figure 3.47 Activity Timeline for alert 174489: the note controls (1), the Assigned event (2) and the Created event by System (3)
A Transaction Monitoring alert has the same layout, with the evidence tabs Analytics, Transactions, Other Cases / Alerts and Rule Analysis in place of Matches (see Transaction Monitoring evidence tabs). The example is ALT-TMS-13092026-187809 for Margarita Ong Abalos: a Closed alert that belongs to a case. Its decision was recorded again on 13 Oct 2026, and the new decision leaves Disposition, Rationale Code and Details blank.
Figure 3.48 A closed Transaction Monitoring alert: the case button (1), the decision block (2), the AI Summary verdict (3), its sections (4) and the footer (5)
An alert that belongs to a case shows a button with the case ID (1) (here CASE-2026-0104894) at the right of the alert bar. Click it to open the case.
A decided alert shows a decision block (2): Rationale Code, Details, Decided On and Decided By. A field with no value is left blank.
The AI Summary opens with its verdict (3). For monitoring alerts its sections (4) include TRANSACTION PATTERN ANALYSIS and RULE TRIGGER ANALYSIS, and the footer (5) gives the prompt version, model and time.
These are the controls on Alert Details as an alert moves from Not Started to a decision. Which controls appear depends on the alert's status and on whether it is assigned and grouped; the table records what the example alerts show.
Alert Details control
Not Started
Under Investigation, assigned, not in a case
Closed, in a case
Start Investigation
PartialShown in grey
No
No
Disposition reads Select outcome
YesGreyed out
YesOpens the list
NoShows the recorded outcome; blank on the example
Group into Case
No
Yes
No
Button with the case ID
No
No
Yes
Decision block (Rationale Code, Details, Decided On, Decided By)
Read Status and Assigned To in the alert bar. On the Not Started example, Start Investigation is shown in grey next to Timeline & Notes and Disposition is greyed out (Figure 3.45). On an alert that is Under Investigation and assigned (1 in Figure 3.49), Start Investigation is not shown and Disposition can be opened.
Step 2Choose a disposition
Open Disposition (Select outcome) (2) and choose True Match, False Match or Potential Match. What happens after you choose is not covered in this edition.
Figure 3.49 An alert Under Investigation: Status and Assigned To (1), the open Disposition list (2) and Group into Case (3)
Step 3Group the alert into a case
An alert that is Under Investigation and not in a case shows Group into Case (3) at the right of the alert bar. From a case, you can also bring ungrouped alerts in with Add Alerts. The result of Group into Case is not covered in this edition.
Alert status changes recorded on screen
Reopening a case reopens the alerts you leave selected. The Reopen Case dialog pre-selects every disposed alert (Uncheck any that should remain closed), and the case timeline then records n alert(s) Reopened with a link to each alert (see Reopen a case). The alert statuses offered by the Status filter are Not Started, Under Investigation, Pending Review, Escalated, Closed and Reopened.
The four Config pages under Case Manager hold the settings behind case work. Administrators use them to choose which alert types are merged into cases and who the cases go to, set up alert assignment, maintain the prompts and model used by Agentic Workflows, and arrange teams into hierarchies. This chapter describes each page, field by field, as it appears on screen.
Open Fyscal ARCX in the sidebar, then Case Manager, then Config. Config lists four pages: Case Creation & Assignment, Alert Assignment, Agentic Workflows and Team Management. The sidebar shortens long names (for example Case Creation …, Team Manage…).
Check this page to see which alert types are turned into cases, how they are grouped and who the cases are assigned to. It shows the configuration that is currently ACTIVE for turning alerts into cases. It has three panels: Merge Alerts to a Case, Alert Type Grouping and Auto Assignment of Cases. The page opens on the Active Configuration tab, read-only, with an Edit button.
Figure 4.1 Case Creation & Assignment, Active Configuration tab: the active configuration's header, Merge Alerts to a Case, Alert Type Grouping (Group 1) and Auto Assignment of Cases.
Active Configuration and Configuration History tabs. History is described in Configuration History.
The configuration header: the ACTIVE status, Created At (17 Sep 2026, 16:39:16 (+05:30) in the example), Created By (a staff member's name), and Config version, a unique ID (bb8448c2-ced2-45f8-8a52-9a825d3c6eaa) with a copy icon.
Merge Alerts to a Case: the helper text reads "Select alert types for case creation". Two checkboxes: Name Screening (tag NS) and Transaction Monitoring (tag TM). In the example only Transaction Monitoring is ticked.
Alert Type Grouping: the information banner reads "Alert types in the same group will merge into a case based on customer ID, case age, and status." Each group is a card headed with its name (Group 1) and a tag (1 Source).
Alert Types: the alert types in the group. Group 1 holds Transaction Monitoring TM.
Case age: a slider with the value in a box to its right, in days (30 in the example). The label has an information icon.
Case Status: the case statuses set for the group, here Escalated and Under Investigation. The label has an information icon.
Auto Assignment of Cases: maps a group to people. The heading has an information icon.
Group: the group the mapping applies to (Group 1), followed by an arrow (→).
Person: the people the group maps to. Three names are shown as tags and the rest are counted in a +2 tag.
Method: the assignment method, here Sequential. The label has an information icon.
Field
What it shows
Options or format seen
Status
Whether this configuration is the one in effect
ACTIVE on this tab; past versions show INACTIVE in Configuration History
Created At
When the configuration was saved
17 Sep 2026, 16:39:16 (+05:30)
Created By
The staff member shown as creator
A staff member's name
Config version
Unique ID of this configuration
A 36-character ID, with a copy icon
Merge Alerts to a Case
The alert types selected "for case creation"
Name Screening (NS), Transaction Monitoring (TM)
Alert Types (per group)
The alert types in the group
Name Screening NS, Transaction Monitoring TM
Case age (per group)
A number of days
Slider and value box, e.g. 30 days
Case Status (per group)
The case statuses set for the group
Escalated, Under Investigation in the example
Group (Auto Assignment)
The group a mapping applies to
Group 1
Person (Auto Assignment)
The people the group is mapped to
Name tags, with a +N tag when more people are selected than are shown
Method (Auto Assignment)
How cases are distributed among the people
Sequential in the example
How the three panels fit together
Alert raisedIts type is ticked under Merge Alerts to a Case
GroupAlert Types, Case age, Case Status
Merged into a caseBy customer ID, case age and status
AssignedGroup → Person, by Method (Sequential)
Diagram 4.1 — From alert to assigned case, as set on this page
Read the page from top to bottom. Merge Alerts to a Case picks the alert types that are turned into cases. Each Alert Type Grouping card says which of those types are merged together. Auto Assignment of Cases then maps each group to one or more people, with a Method for sharing the cases among them.
Use edit mode when you need to change which alerts become cases, how they are grouped or who receives the cases. Edit mode shows the same three panels with editable controls. The header line (status, Created At, Created By, Config version) stays at the top, and Cancel and Save appear at the bottom of the page.
Figure 4.2 Edit mode: removable tags, the Case age slider, Add Group, Add Mapping, and Cancel and Save at the bottom.
Selected values are tags with a remove (×) mark: the group's Alert Types, Case Status values, the mapping's Group and each Person.
Case age: the slider and its value box (30 days).
Add Group, below the last group card. It is shown greyed out in Figure 4.2.
Add Mapping, below the last Auto Assignment mapping.
Cancel and Save. Save is greyed out when edit mode opens.
Step 1Open edit mode
On the Active Configuration tab, click Edit at the top right. The controls become editable and Cancel and Save appear at the bottom of the page.
Step 2Choose the alert types for case creation
Under Merge Alerts to a Case, tick or clear Name Screening and Transaction Monitoring.
Step 3Set up each group
In each group card, set Alert Types (click × on a tag to remove it, or open the field's list with the arrow at its right), move the Case age slider to the number of days you need, and set Case Status in the same way as Alert Types.
Step 4Add a group if needed
Click Add Group below the last group card to add a group.
Step 5Map groups to people
Under Auto Assignment of Cases, choose the Group, the Person or people, and the Method. Click Add Mapping to add another mapping.
Step 6Save or cancel
Click Save to keep your changes, or Cancel to leave edit mode without saving.
Fyscal ARCX→Case Manager→Config→Case Creation & Assignment→Configuration History
Use Configuration History to look back at earlier case creation configurations and open any of them read-only. The Configuration History tab lists the case creation configurations, newest first: the one that is ACTIVE and the earlier ones, which are INACTIVE. The example lists 72 configurations over 4 pages.
Figure 4.3 Configuration History: version IDs, ACTIVE and INACTIVE statuses, creation times, and pagination (Showing 1-20 of 72).
The Configuration History tab.
Configuration: the configuration's version ID, with a copy icon.
Status: ACTIVE or INACTIVE.
Created At: date and time, e.g. 17 Sep 2026, 16:39.
Created By: a staff member's name.
The row count, e.g. Showing 1-20 of 72.
The page indicator (Page 1 of 4) with first, previous, next and last page buttons.
Status
Meaning as shown on screen
ACTIVE
The configuration shown on the Active Configuration tab. One row has this status.
INACTIVE
Every other configuration in the list.
Step 1Open an earlier configuration
Click a row. The Configuration Details dialog opens with the row's status (for example INACTIVE), Config Version ID, Created At (with seconds and time zone offset) and Created By, followed by the same three panels as the Active Configuration tab, read-only. Figure 4.4 shows configuration a9111850-22b7-4275-af80-7b12123ebeaa: Name Screening is ticked under Merge Alerts to a Case, and Group 1 holds Name Screening NS, with a Case age of 30 days and Case Status Escalated and Under Investigation.
Figure 4.4 Configuration Details for INACTIVE configuration a9111850: the status (1), the close button (2), Name Screening ticked (3) and Group 1 holding Name Screening NS (4)
Alert Assignment holds the settings for assigning alerts to people: the alert types it applies to, and for each mapping the people who receive the alerts and the method used to share them out. It works like Case Creation & Assignment: the page opens on the Active Configuration tab, read-only, with an Edit button, and earlier versions are listed on the Configuration History tab.
Figure 4.5 Alert Assignment, Active Configuration tab: the tabs (1), the configuration header (2), Edit (3), the Name Screening (4) and Transaction Monitoring (5) alert types, and Mapping 1 (6) with its Alert Types (7), Person (8) and Method (9)
Active Configuration and Configuration History tabs.
The configuration header: ACTIVE, Created At (07 Oct 2026, 11:32:27 (+05:30) in the example), Created By (a staff member's name) and Config version (8c7e79b2-a825-4746-a6a5-e801ddda5a02) with a copy icon.
Edit opens the configuration for changes (Figure 4.6).
Alert Types ("Select alert types for alert assignment"): Name Screening NS, ticked in the example.
Transaction Monitoring TM, shown greyed out.
Alert Assignment ("Assign alerts to people, distributed by method", with an information icon) holds one card per mapping, here Mapping 1.
Alert Types: the alert types the mapping covers (Name Screening NS), followed by an arrow (→).
Person: the people who receive the alerts, shown as name tags (three in the example; names hidden in the figure).
Method: how alerts are shared among the people, here Load Balance. The label has an information icon.
Field
What it shows
Options or state seen
Alert Types
The alert types the assignment applies to
Name Screening (NS); Transaction Monitoring (TM), greyed out
Alert Types (per mapping)
The alert types a mapping covers
Name Screening NS in the example
Person (per mapping)
The people who receive the alerts
Name tags
Method (per mapping)
How alerts are shared among the people
Load Balance in the example (Case Creation & Assignment shows Sequential)
The Configuration History tab has the same columns as in Configuration History (Figure 4.3): Configuration, Status, Created At and Created By. The example lists 8 configurations: one ACTIVE and seven INACTIVE.
Figure 4.6 Alert Assignment in edit mode: the Name Screening checkbox (1), Transaction Monitoring greyed out (2), a removable tag (3), Add Mapping (4), and Cancel and Save (5)
Name Screening NS can be ticked or cleared.
Transaction Monitoring TM stays greyed out in edit mode.
Selected values are tags with a remove (×) mark: the mapping's Alert Types and each Person.
Add Mapping, below the last mapping. It is shown greyed out in Figure 4.6.
Cancel and Save. Save is greyed out when edit mode opens.
Step 1Open edit mode
On the Active Configuration tab, click Edit. The controls become editable and Cancel and Save appear at the bottom of the page.
Step 2Select the alert types
Under Alert Types, tick the alert types the assignment is for.
Step 3Set up each mapping
In each mapping card, set Alert Types, the Person or people (click × on a tag to remove it, or open the field's list with the arrow at its right) and the Method.
Step 4Save or cancel
Click Save to keep your changes, or Cancel to leave edit mode without saving.
Use Prompt Config to read the prompts behind Case Copilot and the alert summaries, and to compare their revisions. Agentic Workflows has two tabs: Prompt Config, which holds the prompts, and Model Config, which holds the model configuration (see Agentic Workflows: Model Config). Prompt Config shows one card per prompt.
Figure 4.7 Prompt Config: cards for Case Copilot, Name Screening Alert Summary and Transaction Monitoring Alert Summary.
Prompt Config and Model Config tabs.
The prompt name.
The status (Active), the current version (e.g. v2), when it was published and how many revisions it has.
The prompt's description.
The arrow that opens the prompt.
Prompt
Status
Version
Published
Description shown on the card
Where its output appears
Case Copilot
Active
v2
22 Sept, 06:12 PM · 2 revisions
"Case Copilot: the shared persona, formatting rules and analysis rules for every copilot intent."
The Case Copilot panel on Case Details (Case Copilot)
Name Screening Alert Summary
Active
v2
17 Aug, 07:39 PM · 2 revisions
"Summarises a name screening alert by comparing the customer against each watchlist match and judging whether they are the same identity."
"Summarises a transaction monitoring alert using the AMLC investigation framework, mapping activity to Suspicious Circumstance and Predicate Crime codes."
The AI Summary card on a Transaction Monitoring alert (Alert Details: Transaction Monitoring); its footer reads Prompt v3 · Model openai/gpt-oss-120b
Step 1Open a prompt
Click a card. A panel opens on the right with the prompt's name, Edit, a close button (×), the revision navigator and the prompt sections. Figure 4.8 shows Name Screening Alert Summary.
Figure 4.8 The Name Screening Alert Summary panel: Edit, the revision navigator at v2 Active, Description, Task, and the collapsed Role and Expected Response (7 fields).
The revision shown: version (v2), status (Active) and publish time (17 Aug, 07:39 PM). Click it to open the revision picker.
Next revision.
DESCRIPTION: what the prompt is for.
TASK: "Analyze this name screening alert and provide a structured summary."
ROLE, collapsed. Click to expand.
EXPECTED RESPONSE (7 FIELDS), collapsed. Click to expand.
:::
Step 2Pick a revision
Click the revision in the navigator. A list opens with a search box (1) (Find a version, e.g. 7) and one row per version: v2 (2) (marked Active, 17 Aug, 07:39 PM) and v1 (3) (13 Aug, 03:02 PM). The footer (4) reads 7 of 7 loaded. The arrows either side of the navigator are labelled Previous revision and Next revision.
Figure 4.9 The revision picker: the Find a version search (1), v2 Active (2), v1 (3) and the 7 of 7 loaded footer (4)
Step 3Read the Role
Click ROLE (1). For Name Screening Alert Summary v2, the Role opens with "You are a expert AML compliance analyst assistant." and then two lists. INVESTIGATION RULES (2) has eleven rules, starting with the tie-breaker priority "Name > Date of Birth > Nationality > Government ID > Place of Birth > Gender > Address". DATA INTEGRITY RULES (3) has two rules: "Use only supplied data. Never invent identifiers, allegations, or sources. If unknown, say "Unknown"" and "Every substantive claim must cite its source (watchlist record or customer data); output [source: <field_name>] tags".
Figure 4.10 ROLE expanded (1) for Name Screening Alert Summary v2: Investigation Rules (2) and Data Integrity Rules (3)
Step 4Read the Expected Response
Click EXPECTED RESPONSE (7 FIELDS), below the Role. It lists the fields of the response, with a list label on list fields, the allowed values where there are any, and a short description. For Name Screening Alert Summary v2 the fields are:
Edit a prompt when you need to change its Description, Task or Role; publishing creates a new version. Clicking Edit in a prompt panel switches the panel to an edit form. A banner states which version you are editing from and which version publishing creates, for example "Editing from v2 · publishing creates v3".
Figure 4.11 Editing Name Screening Alert Summary: the version banner, Description (136/500), Task and Role, with Cancel and Publish v3.
The version banner: "Editing from v2 · publishing creates v3".
Description with its character counter at the right (136/500).
Task.
Role.
Cancel and Publish v3.
Field
Helper text on screen
Required
Format
Description
what the purpose is for
Yes (*)
Text, with a counter out of 500 characters
Task
one instruction
Yes (*)
Text
Role
persona and rules
Yes (*)
Multi-line text; the rules are written as lines starting with "-"
Step 1Open the prompt for editing
Open the prompt's card on Prompt Config, then click Edit.
Step 2Change the text
Edit Description, Task and Role. Watch the Description counter, which shows the length against 500.
Step 3Publish or cancel
Click Publish v3 (the button names the version that will be created), or Cancel to leave the form without publishing.
Use Model Config to see which model configuration is active, to update it, or to restore an earlier one. The Model Config tab shows the active model configuration at the top and the earlier ones under Previous configurations.
Figure 4.12 Model Config: the Active configuration openai/gpt-oss-120b v3, Edit model, and Previous configurations with Restore.
Prompt Config and Model Config tabs.
The active configuration: Active, the model name (openai/gpt-oss-120b), API key (masked on screen), Version (v3), Temperature (1) and Published At (18 Aug, 10:52 AM).
Edit model opens the Update model dialog.
Previous configurations: a table of earlier configurations.
Restore, one per row.
Rows per page (20), the page indicator and page buttons. The count reads Showing 1-3 of 3.
Column
What it shows
Example
Model
The model name
openai/gpt-oss-120b
Version
The configuration's version label
v2, v1
Status
The configuration's status
Inactive
Temperature
The temperature value
0.2
Published On
When the configuration was published
Aug 13, 2026 03:26 PM
Actions
Row action
Restore
Status
Where it appears
Active
The configuration at the top of the tab
Inactive
The rows under Previous configurations
Step 1Open Update model
Click Edit model. The Update model dialog opens with the text "Saving publishes a new configuration and retires the current one. The API key cannot be read back, so enter it again." Model, Version and Temperature show the current values (openai/gpt-oss-120b, v3, 1 (Creative)). Agent Key is empty.
Figure 4.13 Update model: Model (1), Version (2), Temperature (3), Agent Key (4), and Cancel and Update (5)
Field
Helper text on screen
Required
Options or format
Model (1)
"Give your model a readable, unique name, like openai/gpt-oss-120b. This is how it will display for configuration."
Yes (*)
Text
Version (2)
"Your own label for this configuration. Free text."
"Stored encrypted. It is never displayed again after saving."
Yes (*)
Secret text; placeholder "Secret key used to call the agent"; an eye icon at the right of the field
Step 2Complete the fields
Check or change Model and Version, choose a Temperature, and enter the Agent Key. The dialog states that the key cannot be read back, so it must be entered each time.
Step 3Update or cancel
Click Update (5). As the dialog states, saving publishes a new configuration and retires the current one. Click Cancel or × to close the dialog without saving.
The new configuration becomes the Active one at the top of the tab, and the one it replaces is listed under Previous configurations with the status Inactive.
Team Management lists the hierarchy templates. From here you add a hierarchy, view its details, and open the builder where its roles and members are arranged. A warning sits at the top of the page: "Changing these values may impact system stability. Proceed only if you understand the configuration."
Figure 4.14 Team Management: + Add Hierarchy (1), the warning (2), the search box (3), Show Filters (4) and the list columns, ending with Actions (5)
+ Add Hierarchy opens the Add New Hierarchy Template dialog (see Add a hierarchy).
The Warning banner.
The search box: Search by template ID or name.
Show Filters shows the Status filter. The button then reads Hide Filters.
The columns, ending with Actions, where each row has a ⋮ menu.
Column
What it shows
Example
ID
The hierarchy's numeric ID
4
Name
The hierarchy's name
AML Hierarchy
Created By
The staff member who created it
A staff member's name
Status
The hierarchy's status
Active, Inactive or Removed
Created At
When it was created
Mar 31, 2026 01:59 PM
Updated At
When it was last updated
Mar 31, 2026 01:59 PM
Actions
A ⋮ menu
Edit, View, Hierarchy Builder
Below the list: the row count (for example Showing 1-20 of 89), Rows per page (20), the page indicator (Page 1 of 5) and first, previous, next and last page buttons. The list is ordered by ID, highest first, so the example AML Hierarchy (ID 4) is on the last page.
Status
Meaning as shown on screen
Active
Shown in green. Also the default Status for a new hierarchy.
Inactive
Shown in red. Can be chosen when adding a hierarchy.
Removed
Shown in blue. Available as a filter value.
Step 1Find a hierarchy
Type a template ID or name into Search by template ID or name.
Step 2Filter by status
Click Show Filters; the button now reads Hide Filters (1). A Status filter appears above the list. Open Select Status (2) and choose Active, Inactive or Removed (3). Click Hide Filters to hide the filter again.
Figure 4.15 Filters shown: Hide Filters (1), the Status filter (2) and its list, Active, Inactive and Removed (3)
Step 3Open a row's actions
Click ⋮ (1) in the Actions column. The Actions menu lists Edit (2), View (3) and Hierarchy Builder (4).
Figure 4.16 A row's ⋮ button (1) and its Actions menu: Edit (2), View (3) and Hierarchy Builder (4)
Use this dialog when you need a new hierarchy template. + Add Hierarchy opens the Add New Hierarchy Template dialog: "Create a new hierarchy template to define organizational structures."
Figure 4.17 Add New Hierarchy Template: Name (1), Status (2), Description (3), and Cancel and Add (4)
#
Field
What it expects
Required
Options or format
1
Name
The hierarchy's name
Yes (*)
Text; placeholder "e.g. Sales Regional Hierarchy"
2
Status
The hierarchy's status
No
Active (default), Inactive
3
Description
A description of the hierarchy
No
Multi-line text; placeholder "e.g. Standard template for multi-level sales team reporting"
4
Cancel / Add
Close without saving, or add the hierarchy
–
Add is greyed out when the dialog opens empty
Step 1Open the dialog
Click + Add Hierarchy at the top right of Team Management.
Step 2Complete the form
Enter a Name, leave Status at Active or choose Inactive, and add a Description if you need one.
Step 3Add or cancel
Click Add, or Cancel or × to close the dialog without adding.
Open a hierarchy's details to check its IDs, description, status and dates without changing anything. Choose View from a row's Actions menu. A details dialog opens, titled View API Key (1), with a two-column table (Name, Value) and a Close button. Figure 4.18 shows the details of AML Hierarchy, ID 4.
Figure 4.18 Details of AML Hierarchy (ID 4): the dialog title (1), the template ID in the row labelled User ID (2), Created By shown as a number (3) and Close (4)
Use the Template Builder tab to see which roles a hierarchy has and the level each role sits at. Choosing Hierarchy Builder from a row's Actions menu opens the builder for that hierarchy. The builder has two tabs, Template Builder and Hierarchy Builder. The Template Builder tab is headed Hierarchy Template Builder: "Create a template, assign roles, and arrange their hierarchy levels."
Figure 4.19 Template Builder for AML Hierarchy: the tabs (1), Template Configuration (2), Available Roles with its search (3), and Hierarchy Levels marked Persisted Hierarchy (Read-only) with L0 AML Admin to L3 AML Analyst (4); the level list scrolls, so L3 is partly hidden
The Template Builder and Hierarchy Builder tabs.
Template Configuration: TEMPLATE NAME, here AML Hierarchy.
Available Roles ("Click a role to assign it"): a Search roles... box and the role list. For AML Hierarchy the list shows No matching roles found.
Hierarchy Levels, tagged Persisted Hierarchy (Read-only) with the text "Structure is locked and cannot be changed". Each level is a row with a drag handle, the level (L0 to L3), the role, and a greyed-out × at the right.
Use the Hierarchy Builder tab to see who belongs to each depth of the hierarchy and how the members are connected. The Hierarchy Builder tab shows the hierarchy as a chart on a canvas. Each person is a card labelled with their role (for example AML ADMIN, AML TEAM LEAD) and their name, and lines connect each card to the cards at the next depth below it. On this tab the sidebar is shown as a narrow icon rail.
Figure 4.20 Hierarchy Builder for AML Hierarchy: the tabs (1), the depth panel (2), the person-and-plus button (3), Save (4) and the zoom controls at 50% (5); member names hidden
The Template Builder and Hierarchy Builder tabs.
The depth panel: one card per depth (Depth 0 AML ADMIN, Depth 1 AML TEAM LEAD, Depth 2 AML SUPERVISOR, Depth 3 AML ANALYST), each with its member count and member initials.
A button with a person-and-plus icon on the Depth 0 card.
Save, at the top right. It is shown greyed out in Figure 4.20.
Zoom out, the zoom level (50% when the tab opens) and zoom in.
Customer 360 is where you look a customer up. Analysts and reviewers use it during an investigation to find a customer in the list and open their Customer Profile, which brings together identity and KYC details, accounts, transaction analytics, transactions, prior cases and alerts, screening history and STR history. Administrators set up the customer risk profile (CRP) next to it, under Customers: which customer details are scored, how much each one weighs, and the score bands that turn a score into a risk level.
For
Analysts, supervisors and team leads; administrators for the CRP
Start from the customer list to find the customer you need. The Customer 360 page shows one row per customer, with a search box, a Refresh button and a Show Filters button above the table.
Figure 5.1 The Customer 360 list: search (1), Refresh (2), Show Filters (3), the column headings (4), a customer row (5) and the Score tag (6)
Search by Customer Name / ID: finds customers by name or Customer ID.
Refresh: reloads the list.
Show Filters: opens the filter bar (KYC Level, Risk Tier, Country). The button then reads Hide Filters.
Column headings: Customer Name / ID, KYC Level, Risk Level, Score, Country, Created At.
A customer row: initials avatar, customer name, and the Customer ID with a copy icon.
Score: the score band and percentage, as a coloured tag (here High 62.61%).
Column
What it shows
Format or values seen
Customer Name / ID
The customer's name (individual or business), with the Customer ID below it and a copy icon next to the ID. Long names are shortened with "…".
For example Bienvenido Salazar Ocampo, C019-0000010
KYC Level
The customer's KYC level as held in the customer data.
Use the search box to find one customer, and the filters to narrow the list by KYC level, risk tier or country.
Filter
Default
Options shown
KYC Level
All
All, Advanced, Basic, Complete
Risk Tier
All
A list with a search box: Low, Medium, High
Country
All
A list of country names with a search box, in alphabetical order from Afghanistan (243 options, including Unknown).
Step 1Search for a customer
Click the Search by Customer Name / ID box and type the customer's name or Customer ID, for example CUST-FYSCAL-604554.
Step 2Open the filters
Click Show Filters. Three filters appear below the search box: KYC Level (1), Risk Tier (2) and Country (3), each set to All. The button now reads Hide Filters (4); click it to close the filter bar.
Figure 5.3 The filter bar: KYC Level (1), Risk Tier (2) and Country (3), with Hide Filters (4)
Step 3Filter by KYC Level
Click the KYC Level box (1) and choose one option. A tick marks the current choice (All (2)). The other options are Advanced, Basic and Complete.
Figure 5.4 The KYC Level filter (1): All ticked (2), then Advanced, Basic and Complete
:::
Step 4Filter by Risk Tier
Click the Risk Tier box. The list has a search box (1), followed by Low, Medium and High. Click the tier to show.
Figure 5.5 The Risk Tier filter: the search box (1), then Low, Medium and High
:::
Step 5Filter by Country
Click the Country box. Type part of a country name in the search box (1) at the top of the list, then click the country. The list (2) is alphabetical and long (243 options), so searching is quicker than scrolling.
Figure 5.6 The Country filter: the search box (1) and the alphabetical list of countries (2)
Open the Customer Profile to see everything held on one customer: profile tags, financial details, accounts and the tabs described below, starting with the Customer Risk Score. Click a customer in the list to open the Customer Profile. The breadcrumb reads **Fyscal ARCX › Customer 360 ›**customer name; click Customer 360 in it to return to the list. The examples in this chapter use the customer Rafael Serrano Dimaculangan (CUST-FYSCAL-604554).
Figure 5.7 The Customer Profile for Rafael Serrano Dimaculangan: name and ID (1), profile tags (2), More (3), summary cards (4), Accounts (5) and the tabs, starting with Customer Risk Score (6)
The customer's name, initials avatar and Customer ID (with a copy icon).
Profile tags: TYPE, SEGMENT, RISK, KYC, STATUS, COUNTRY and PEP Flag.
More: expands the profile card with three detail panels (Figure 5.8). It then reads Less.
Accounts (1): the customer's accounts, with the number of accounts in brackets.
Tabs: Customer Risk Score (selected: the profile opens on it), Analytics, Transactions (with a count, here 19), Other Cases / Alerts, Screening History, STR History and Additional Data (greyed out, not described in this edition).
Field
What it shows
Example
TYPE
Customer type.
INDIVIDUAL
SEGMENT
Customer segment.
Retail
RISK
Risk tier, with a number in brackets.
HIGH (77)
KYC
KYC level.
L2
STATUS
Customer status.
ACTIVE
COUNTRY
Customer country.
PHILIPPINES
PEP Flag
Whether the customer is flagged as a politically exposed person.
No
DECLARED INCOME
Income declared by the customer.
₱2,323,206.00
EXPECTED MONTHLY SPEND
Expected monthly spend.
₱1,710,199.43
SOURCE OF FUNDS
Declared source of funds.
Employed
ONBOARDING
Onboarding channel.
via API
Accounts row
Account number, account type, institution and account status, with an expand arrow at the right.
account number (hidden in the figures), SALARY, Land Bank of the Philippines, ACTIVE
Step 1See the full customer details
Click More at the top right of the profile card. Three panels open between the summary cards and Accounts. The button now reads Less (1); click it to close them.
Figure 5.8 The profile card expanded: Less (1), BUSINESS & EMPLOYMENT (2), FINANCIAL INFORMATION (3) and Additioanl Details (4)
Panel
Fields
Example values
2 BUSINESS & EMPLOYMENT
Designation, Employer, Segment, Source of Funds, Country of Operations
The Customer Risk Score tab shows the result of the customer risk profile (CRP) for one customer: their risk score, its band, and how each attribute adds to it. It is the first tab of the Customer Profile. The same score appears as a coloured tag next to the customer's name, so you see the risk level as soon as you open the profile.
Figure 5.9 The Customer Risk Score tab for Emiliano Earl Gica Alvarez: the score tag next to the name (1), the Customer Risk Score tab (2), the total with the Config version (3), one attribute with its value, weightage and score (4), and the two reasons a value scores 0 (5, 6)
The risk score as a tag next to the customer's name, in the colour of its band: LOW 9%.
Customer Risk Score: the first tab of the profile.
Customer Risk Score with the Config version used to calculate it (1793012340951, the active version in Configuration history), and the total, LOW 9%.
An attribute: its name (KYC Level), the customer's value (KYC 0), the attribute's Weightage (14%) and the value's Score (10).
No value provided. Scored 0.: the customer data has no value for this attribute (PEP Status shows —), so it scores 0.
Unable to match value to any scoring row. Scored 0.: the message shown when the customer has a value (DRIVERS_LICENSE) that no row of the attribute matches. This screen shows the attribute with Score 0; how such a value is scored is not confirmed for this edition (see Customer risk profile (CRP)).
Each row shows the attribute's Weightage and the Score of the customer's value. The total at the top is the sum of score × weightage for all attributes, as described in How the risk score is worked out. For this customer:
Use Analytics for a summary of how money moves in and out of the customer's accounts. Analytics is the tab that is open when the profile loads. It summarises the customer's incoming and outgoing transactions, the top counterparties and the transaction types. The panel header shows the customer's name.
Figure 5.10 Analytics: the period buttons (1), Alert Window (2), and the INCOMING (3) and OUTGOING (4) totals per currency
Period buttons: 1D, 7D, 30D, All. In the figure, All is selected.
Alert Window: a check box, shown unticked and greyed in the figure.
INCOMING: one row per currency, each with TOTAL (amount, and the number of transactions and senders, for example "4 txns · 4 senders"), AVG and MAX (amount and the transaction ID of the largest transaction).
OUTGOING: the same layout for money sent, counting recipients instead of senders.
In the example, incoming money is shown in PHP, USD, JPY and SGD, and outgoing money in PHP, USD, EUR and JPY. Totals are not converted to a single currency.
Figure 5.11 Analytics: Top Counterparties by Amount (1) with 14 more Counterparties (2), and Transaction Types (3) with 4 more Types (4)
Top Counterparties by Amount: the five largest counterparties, ranked, each with name, ID (with a copy icon), amount, number of transactions and a bar at the right.
14 more Counterparties (in the example): lists the rest of the counterparties.
Transaction Types: the five largest transaction types (for example TIME_DEPOSIT, DEPOSIT, BILLS_PAYMENT), each with amount, number of transactions and a bar.
4 more Types (in the example): lists the rest of the transaction types.
Use the Transactions tab when you need the individual transactions behind the analytics, or a CSV export of them. The Transactions tab shows charts of the customer's transaction activity and a table of the transactions. The count on the tab (19 in the example) is the number of transactions.
Figure 5.12 The Transactions tab: the Transaction Trends / Volume Heatmap switch (1), grouping and date range (2), the Transaction Volume (3) and Transaction Count (4) charts, Expand (5), the table filters (6), Export CSV (7), the Channel column (8) and a row's expand arrow (9)
Transaction Trends / Volume Heatmap: switches the Transaction Pattern view. Transaction Trends is selected in the figure.
The grouping buttons Day, Week, Month (Day selected) and the date range (here 10 Oct - 14 Oct, with a calendar icon).
Transaction Volume chart for the selected date range.
Transaction Count chart for the selected date range.
Each chart has an expand button at its top right (Expand Transaction Volume, Expand Transaction Count).
Transaction Table filters: All Types, All Channels, Price range, Pick a date range, Sender ID, Receiver ID.
Export CSV, at the right of the tab bar.
Channel: the channel of each transaction, for example ONLINE_BANKING, OTC, POS.
The arrow at the end of each row.
In the example, the charts cover 10 Oct to 14 Oct and show no activity, while the table lists 19 transactions dated 21 Jul. Change the date range above the charts to chart a different period.
Column
What it shows
Example
Txn ID
Transaction ID, with a copy icon.
TXN-752684-ORQ
Sender
Sender name and ID.
Rafael Serrano Dimaculangan, CUST-FYSCAL-604554
Receiver
Receiver name and ID.
Manila Water, EXT-OVS-65825715
Amount
Amount in the transaction currency.
₱2,904.98; SGD 2,983.40; $3,810.03; €6,875.71
Type
Transaction type. Long types are shortened with "…".
Check this tab to see whether the customer has been investigated before. The Other Cases / Alerts tab lists the cases and alerts raised for this customer. Cases are managed in Case Manager.
Figure 5.13 Other Cases / Alerts: the Cases and Alerts sub-tabs (1), the Status and Date Range filters (2), and one case, CASE-2026-0034611, in status STR Created (3)
Sub-tabs Cases and Alerts, each with a count (1 case and 34 alerts in the example).
Filters: Status and Date Range.
A case row: the case title with the case ID below it; the columns are described in the table below.
Column (Cases)
What it shows
Example
Case Title / ID
Case title, with the case ID and a copy icon below it.
ALT-TMS-21072026-041467, CASE-2026-0034611
Status
Case status.
STR Created
Disposition
Case disposition.
True Match
Assigned To
The user the case is assigned to.
(hidden in the figure)
Alerts
Number of alerts in the case.
1
Case Age
Age of the case.
75 Days
Case Origin
How the case was created.
-
Created At
Date and time the case was created. The heading has a sort icon.
Use this tab to see when the customer was screened against the watchlists and with what result. The Screening History tab lists the name-screening runs that included this customer, newest first.
Figure 5.14 Screening History: the Status and Screening Period filters (1) and the columns (2), with six Delta Screening runs, each with No Alerts
Filters: Status (default All Status) and Screening Period (Pick a date range).
Date and time of the run, with the RUN ID (and a copy icon) below it.
Sep 23, 2026, 11:03 AM; RUN ID 466
Screening Type
The kind of screening run.
Delta Screening
Alert Score
The result of the run for this customer.
No Alerts
The example shows six runs (RUN IDs 466, 465, 464, 463, 430 and 397), all Delta Screening with No Alerts. Screening runs are described in Name Screening.
Use this tab to check whether STRs have already been filed that involve the customer. The STR History tab lists Suspicious Transaction Reports (STRs) linked to this customer, in the same columns as the STR Listing register.
Figure 5.15 STR History: the Created By and Creation Period filters (1), the columns (2) and the Download CSV icon (3), with STR 661 for case CASE-2026-0034611, amount ₱707,955.42
Filters: Created By (default All Assignees) and Creation Period (Pick a date range).
The columns, described in the table below.
Download CSV: a download icon in each row.
Column
Example
Case Title / ID
ALT-TMS-21072026-041467, CASE-2026-0034611
STR ID
661
Created At
14 Aug, 07:36:00 AM
Created By
(hidden in the figure)
Subjects
Pooja Sharma, David Lee, Estrella Abella Catalan
Amount
₱707,955.42
Download CSV
A download icon (3 in the figure)
The case in this row, CASE-2026-0034611, is the case listed under Other Cases / Alerts. For what each column means and how to open a filed STR, see STR Listing.
Use the Customer Profile to compare what the customer said they would do with what they actually did, and to check their history. Work through it in the order below and note what you find in the case's Timeline and notes.
The order goes from what the customer declared, to what they did, to what the institution already knows about them. Each step below matches one box of the diagram.
Step 1Read the profile
Open the customer (see The Customer Profile). Note RISK, KYC, STATUS and PEP Flag, then click More and note Expected Monthly Spend, Purpose, Expected Txn Frequency and Sanctions. Check the account status under Accounts.
Step 2Check the risk score
On Customer Risk Score, note the score and its band, which attributes add the most to it, and any attribute scored 0 because of No value provided or Unable to match value to any scoring row.
Step 3Compare with the Analytics totals
On Analytics, choose the period (1D, 7D, 30D or All) that you want to compare with the profile. Read INCOMING and OUTGOING one currency at a time: totals are not converted to a single currency. Note the largest transaction (MAX) and the top counterparties.
Step 4Check the individual transactions
On Transactions, find the transactions behind the totals: their dates, types and counterparties. Set the date range above the charts to the period of the transactions, and use Export CSV if you need the list outside the platform.
Step 5Look for earlier cases and alerts
On Other Cases / Alerts, check the Cases and Alerts counts and the status and disposition of earlier cases.
Step 6Check the screening results
On Screening History, check when the customer was last screened and the Alert Score of each run.
Step 7Check for earlier STRs
On STR History, check whether STRs have already been filed and open them in STR Listing if you need the detail.
Worked example: profile against activity
The values below are all on screen for Rafael Serrano Dimaculangan (CUST-FYSCAL-604554), with All selected on Analytics (Figure 5.10) and the profile expanded with More (Figure 5.8). The Transactions tab lists 19 transactions, all dated 21 Jul.
Profile says
Activity shows
Point to note in the case
Expected Monthly Spend ₱1,710,199.43
OUTGOING PHP 915,874.18 (8 txns · 8 recipients), plus USD 198,759.28, EUR 6,875.71 and JPY 3,131.98 in one transaction each
Compare spend currency by currency; the foreign-currency amounts are not included in the PHP total.
Expected Txn Frequency QUARTERLY
19 transactions, all on 21 Jul
Many transactions on one day against a quarterly expectation.
More PHP sent out than received, against a stated purpose of receiving remittances.
Designation Cook; Declared Income ₱2,323,206.00
Largest outgoing transaction PHP 704,823.44 (TXN-455164-KJX) to Estrella Abella Catalan
The size of single transactions against the stated occupation and income.
Sanctions REVIEW_REQUIRED
Screening History: six Delta Screening runs, each No Alerts
What the REVIEW_REQUIRED value refers to, and whether it has been resolved.
None of these points decides the case on its own. Record them, with the values, in your notes and in the rationale when you dispose the alerts (see Dispose alerts and close a case).
The customer risk profile (CRP) gives every customer a risk score from 0 to 100, worked out from their customer data. Administrators decide which customer details count towards the score and how much each one counts; the platform applies the same settings to every customer. The CRP is set up on two pages under Customers, next to Customer 360:
Risk Score Configuration: the attributes that are scored, the score of each attribute value, and the weightage of each attribute.
Score Configuration: the score bands, such as Low, Medium and High, that turn a score into a risk level.
Each customer's score, and how each attribute adds to it, is shown on the Customer Risk Score tab of their Customer Profile.
Who
Administrators and compliance heads who own the risk methodology
Made in a draft, then activated; every version is kept in the history
Limits
Each value score 0 to 100; weightages 100% in total at most
How the risk score is worked out
The configuration has three parts. Each attribute is a customer detail, such as KYC Level, PEP Status or Nationality. Each attribute has rows that give a Score from 0 to 100 to one or more of its values, for example KYC 1 scores 20 and KYC 0 scores 10. Each attribute also has a Weightage, the share of the total risk score it carries, in per cent.
AttributesCustomer details to score, e.g. KYC Level, PEP Status
Value scores0 to 100 for each value, e.g. PEP = 80
Weightage% per attribute, 100% in total at most
Risk score0 to 100 for each customer
Score bandLow, Medium or High (Score Configuration)
Diagram 5.2 — From customer data to a risk level
For each attribute, the platform takes the score of the customer's value and multiplies it by the attribute's weightage. The risk score is the sum of these weighted scores:
Risk score = (score × weightage) for each attribute, added together
The score used for each attribute is the score of the row that matches the customer's value. There is no normalisation, and the scores of the rows within one attribute do not have to add up to 100: each row's score stands on its own.
Because every value score is between 0 and 100 and the weightages add up to 100% at most, the risk score is always between 0 and 100. The score bands in Score Configuration then give the risk level: with the bands of the draft shown in Set the score bands, a score below 71 is Low, 71 to below 80 is Medium, and 80 to 100 is High.
Worked example
These values are from the Customer Risk Score tab of the customer Emiliano Earl Gica Alvarez (Figure 5.9), scored with the active configuration in Figure 5.17.
Attribute
Weightage
Customer's value
Value score
Weighted score
KYC Level
14%
KYC 0
10
10 × 14% = 1.4
PEP Status
20%
none
0
0 × 20% = 0
Nationality
7%
Philippines
5
5 × 7% = 0.35
Country of Residence / Operation
17%
Philippines
5
5 × 17% = 0.85
Age
16%
19-42
10
10 × 16% = 1.6
ID Type
10%
DRIVERS_LICENSE
0 (no matching row)
0 × 10% = 0
Occupation
16%
Homemaker
30
30 × 16% = 4.8
Total
100%
9, band Low
Occupation adds the most here: 4.8 of the 9 points. If the same customer were a PEP, PEP Status would add 80 × 20% = 16 points and the score would be 25. Raising an attribute's weightage makes its values move the risk score more; lowering it makes them count less.
When the customer data has no value for an attribute, the Customer Risk Score tab shows No value provided. Scored 0. for it.
Open Risk Score Configuration to see the attributes, scores and weightages in use. The page has two tabs: Active Configuration, the configuration in force, and Configuration History, every version saved (see Configuration history).
Step 1Start when no attributes are configured
Before any attribute is added, the page shows 0 Attributes and the message No attributes configured yet, and Total Weightage is 0%. Click Add Attributes, tick the attributes to score, and click Add. Edit and Activate stay unavailable until there is something to activate.
Figure 5.16 A configuration with no attributes: Cancel, Save Draft, Edit and Activate (1), Total Weightage 0% (2), the empty-state message (3), Add Attributes (4) and the list of attributes to choose from (5)
Cancel, Save Draft, Edit and Activate. Edit and Activate are greyed out while there is nothing to edit or activate.
Total Weightage: 0% with the Totals 0% tag: no weightage has been given yet.
No attributes configured yet: risk scores are calculated from the attributes you add.
Add Attributes: opens the list of customer attributes.
The attributes to choose from, each with a checkbox; Select All ticks them all.
Step 2Read the active configuration
When a configuration is active, the page shows who created it and when, its Config version and the status ACTIVE. The Total Weightage panel shows each attribute's weightage as a bar, and each attribute below lists its values and their scores.
Figure 5.17 The active configuration: the tabs (1), the version details (2), Edit (3), the Total Weightage panel (4), Expand All (5) and the KYC Level attribute with its values and scores (6)
Active Configuration and Configuration History tabs.
Created At, Created By, Config version and Status (ACTIVE).
Edit: starts a draft of a new version.
Total Weightage: 100% with Totals 100%, and a bar for each attribute's weightage (here KYC Level 14%, PEP Status 20%, Nationality 7%, Country of Residence / Operation 17%, Age 16%, ID Type 10%, Occupation 16%).
Expand All: opens every attribute to show its values.
An attribute, KYC Level, with Weightage 14%: the value KYC 1 has Score 20 and KYC 0 has Score 10.
Step 3Edit: work in a draft
Click Edit. The page opens a draft with the status DRAFT and its own Config version; the active configuration stays in force until you activate the draft. Each attribute now has a Weightage box, a delete icon and an arrow that opens its values.
Figure 5.18 A draft: the version details with DRAFT (1), Cancel, Save Draft, Discard draft and Activate (2), the Total Weightage panel (3), the Weightage box (4), and the delete icon and arrow (5)
Created At, Created By, Config version and Status: DRAFT.
Cancel leaves editing; Save Draft saves it without activating; Discard draft deletes the draft; Activate makes the draft the active configuration.
Total Weightage and the Totals tag, updated as you type.
Weightage of the attribute, in per cent.
The delete icon removes the attribute from the draft; the arrow opens its values.
Step 4Add attributes
Click Add Attribute below the last attribute. In the dialog, tick each customer attribute to score, or Select All, and click Add. The attributes are added to the draft, each with a weightage to fill in.
Figure 5.19 The Add Attribute dialog: Select All (1), the customer attributes with three ticked (2), and Cancel and Add (3)
Select All: ticks every attribute in the list.
The customer attributes, for example Customer Type, Status, Customer Segment, Risk Level (ingested), Risk Score (ingested), Sanctions Status, Source of Funds, Relationship Tenure, Onboarding Channel, City, Province / Region and Address Country; scroll for more.
Cancel closes the dialog; Add adds the ticked attributes.
Step 5Give each value a score
Open an attribute with its arrow. Each row links one or more values of the attribute to a score: choose the values in the row's list (they appear as tags, such as KYC 1), then type the Score, from 0 to 100. Click Add Row for another value, and the delete icon at the end of a row to remove it.
Figure 5.20 Scoring the values of KYC Level: Weightage (1), a row with its value KYC 1 and Score 20 (2), the delete icon of the row (3) and Add Row (4)
Weightage of the attribute (here 14%).
A row: the value or values it applies to (KYC 1), and its Score (20).
Deletes the row.
Add Row: adds a row for another value.
Step 6Set the weightages
Type a Weightage for each attribute. Watch Total Weightage at the top: the weightages of all attributes together must not exceed 100%. When they add up to exactly 100%, the tag reads Totals 100% and the risk score can use the full range from 0 to 100.
Step 7Save or activate
Click Save Draft to keep the draft and come back to it later, or Activate to put it in force. The activated version becomes ACTIVE in Configuration history, and the version that was active before becomes INACTIVE. To drop the draft, click Discard draft.
Rules the configuration follows
What
Allowed
Example
Score of a value row
A number from 0 to 100. Higher means more risk.
PEP → 80
Weightage of an attribute
A percentage from 0 to 100.
PEP Status → 20%
Total Weightage
The weightages of all attributes together: 100% at most.
14 + 20 + 7 + 17 + 16 + 10 + 16 = 100%
Risk score of a customer
Always between 0 and 100, because of the two rules above.
Score Configuration sets the bands that turn a risk score into a risk level. Each band has a name, a colour and a score range; together the bands cover the whole range from 0 to 100. Like the risk score configuration, the bands are changed in a draft and then activated, and every version is kept under Score Configuration History.
Figure 5.21 A draft of the score bands: the tabs (1), the draft details (2), Cancel, Save Draft, Discard draft and Activate (3), the name and colour of the Low band (4), its Min score and Max score (5), the delete icon (6) and Add band (7)
Active Score Configuration and Score Configuration History tabs.
Draft Score Configuration: Created At, Created By, Config version and Status: DRAFT.
Cancel, Save Draft, Discard draft and Activate, as for the risk score configuration.
Name (Low) and Color (#15803D, green) of the band.
Min score and Max score. The band includes its minimum and goes up to, but not including, its maximum (< 71). Min score cannot be edited: it follows the previous band's Max score.
Deletes the band.
Add band: adds a band.
The bands of the draft in Figure 5.21, which is not the active configuration:
Band
Color
Scores
Low
#15803D (green)
0 to below 71
Medium
#d9c708 (yellow)
71 to below 80
High
#e90c0c (red)
80 to 100
Step 1Change the bands
Open the draft and edit a band's Name, Color or Max score. You only type the maximum. Min score cannot be edited: each band's Min score follows the previous band's Max score automatically (here Medium starts at 71 because Low ends below 71). The first band starts at 0 and the last band ends at ≤ 100.
Step 2Add or remove a band
Click Add band to add a band, or the delete icon to remove one. Check that the bands still run from 0 to 100 without a gap.
Step 3Activate
Click Activate to put the bands in force, or Save Draft to finish later.
Fyscal ARCX→Customers→Risk Score Configuration→Configuration History
Every version of the risk score configuration is kept. Open the Configuration History tab to see which version is in force, who created each version and when. Score Configuration has the same list under Score Configuration History.
Figure 5.22 Configuration History: the tabs (1), a Config Version ID with its copy icon (2), the status ACTIVE (3), Created by (4), the count line (5) and the page controls (6)
Active Configuration and Configuration History tabs.
Config Version ID, with a copy icon.
Status: ACTIVE for the version in force, INACTIVE for earlier versions, and DRAFT for a draft not yet activated.
Created by: the user who created the version.
Showing 1-20 of 22: 20 versions per page.
Page 1 of 2 and the first, previous, next and last page buttons.
Status
Meaning
ACTIVE
The version in force. Only one version is active at a time.
DRAFT
Saved with Save Draft and not yet activated.
INACTIVE
An earlier version, replaced when a newer one was activated.
Use the history to answer an auditor's question about which risk methodology applied on a given date: find the version that was ACTIVE at that time, by its Created date and the date of the next activation.
STR Listing is the register of Suspicious Transaction Reports (STRs) filed on the platform, one row per STR. Analysts and reviewers use it to find a filed STR, download its CSV, and open it to read what was reported in each of its six steps. STRs are filed from a case in Case Manager, not from this page.
Diagram 6.1 — Where an STR is filed and where it appears afterwards
An STR is prepared from a case in Case Manager with the six-step STR wizard. A filed STR appears as a row in this register. In the examples, the case then shows the status STR Created with Download STR, and STRs are also listed on the STR History tab of a customer in Customer 360. The field-by-field reference for the six steps is in Case Manager (Step 1 to Step 6); this chapter shows what a filed STR looks like, using STR 694.
Use the register to see the filed STRs and pick the one you need. The STR Listing page shows the filed STRs, newest first, with a search box, a Refresh button and a Show Filters button above the table.
Figure 6.1 The STR Listing register: search (1), Refresh (2), Show Filters (3), an STR row (4), Download CSV (5), and the count line with the page controls (6)
Search by Case Title / Case ID / STR ID: finds STRs by the case title, the case ID or the STR ID.
Refresh: reloads the register.
Show Filters: opens the filters Creation Period and Created By. The button then reads Hide Filters.
An STR row. Click a row to open that STR (see Open a filed STR).
Download CSV: the download icon on each row downloads a CSV file for that STR.
The count line (Showing 1-10 of 127) and, at the right, Page 1 of 13 with first, previous, next and last page buttons. The register shows 10 STRs per page.
Column
What it shows
Example
Case Title / ID
The title of the case the STR was filed from, with the case ID and a copy icon below it. The case title is often the customer's name; it can also be an alert ID.
Use the search box when you know the case title, case ID or STR ID, and the filters to narrow the register by creation date or by the user who created the STR.
Filter
Default
Options or format
Creation Period
Pick a date range
A two-month calendar (for example October 2026 and November 2026) with arrows to move between months. Today's date is highlighted.
Created By
All Assignees
A list of users. Your own entry is marked (You); in testing it was the only entry.
Step 1Search for an STR
Click the Search by Case Title / Case ID / STR ID box and type a case title (for example Harish Sinha), a case ID (for example CASE-2026-0000075) or an STR ID (for example 694).
Step 2Open the filters
Click Show Filters. The Creation Period (1) and Created By (2) filters appear below the search box, and the button reads Hide Filters (3). Click Hide Filters to close them.
Figure 6.2 The STR Listing filters: Creation Period (1) and Created By (2), with Hide Filters (3)
Step 3Filter by the user who created the STR
Click the Created By box (1) (it shows All Assignees) and click a user in the list (2). In testing, the list showed one entry, the signed-in user, marked (You).
Figure 6.3 The Created By filter (1) open, with one entry marked (You) (2); the user name is hidden
Step 4Filter by creation date
Click the Creation Period box (it shows Pick a date range). A two-month calendar opens. Pick the start and end dates of the range. Use the arrows (1, 2) beside the month names to change month. Today's date is highlighted (3).
Figure 6.4 The Creation Period calendar, October and November 2026: previous month (1), next month (2) and today's date highlighted (3)
Step 5Download an STR's CSV
In the row of the STR, click the download icon in the Download CSV column (5 in Figure 6.1).
Open a filed STR to read exactly what was reported, step by step. Click an STR row to open it. The STR opens in a dialog over the page, titled Suspicious Transaction Report (STR), with the subtitle GoTRACS-compliant STR filing for AMLC and the case ID. The dialog has six steps, the same steps used to file an STR from a case: Select Alerts, Report Type, Reason for suspicion, Transaction, Subject parties and Narratives. A filed STR opens read-only: its values are shown in greyed fields and ticked or unticked boxes, and there is no save or submit button. Behind the dialog, the sidebar is shown collapsed to a narrow strip of icons.
The figures below show STR 694, filed from case CASE-2026-0000075 (Harish Sinha).
Control
What it does
Step bar
Shows the six steps. The current step has a blue number; steps already passed show a green tick.
This step shows which of the case's alerts the STR covers. It lists the case's alerts under the heading Alerts to include in STR, with the instruction Transactions and parties from selected alerts appear in subsequent steps. A ticked box marks each alert included in the STR.
Figure 6.5 Step 1, Select Alerts, for STR 694: the title and case ID (1), the current step (2), an included alert (3), the one alert not included (4) and Next Step (5)
Dialog title, subtitle and case ID (CASE-2026-0000075).
Step bar, with Select Alerts as the current step.
An included alert: a ticked box, the customer name and the alert's disposition (here Harish Sinha, False Match), then the alert ID, the customer ID, the rule and, for transaction-monitoring alerts, the number of transactions.
The alert that is not included: its box is unticked (ALT-NS-20260827104653114064, Aman Singh, in the example).
Next Step.
Each alert shows the customer name, the alert's disposition (for example False Match or True Match; none when the alert has no disposition), its alert ID (for example ALT-TMS-20260626072003.357618915-d24534), the customer ID (for example TEM-CUST-10L847), the rule (for example Rule: TMR-26062026-000367) and, for transaction-monitoring alerts, the number of transactions (for example 1 transactions). Name-screening alerts (IDs starting ALT-NS) show Rule: with no value.
This step shows the type of report and its filing details, including the date of determination from which the filing deadline is worked out.
Figure 6.6 Step 2, Report Type: STR Type (1), Institution code (2), Supervising agency (3), Submission type (4), STR trigger (5), Date of determination (6) and the Filing deadline message (7)
#
Field
Value in STR 694
1
STR Type
STRR - Regular STR
2
Institution code H-3
FYSCALTECH20260001 (marked auto-filled)
3
Supervising agency H-2
Securities and Exchange Commission
4
Submission type H-6
Delete
5
STR trigger D-SD-3
PPP (Public Private Partnership)
6
Date of determination D-SD-2
24/08/2026
7
Filing deadline message
Filing deadline: August 31, 2026 (Overdue by 44 days)
For each field's options, required marker and help text, see Step 2: Report Type in Case Manager. The five STR types are compared in STR types compared.
Next to the date, a message shows the filing deadline worked out from it: in the example, Filing deadline: August 31, 2026 (Overdue by 44 days) on 14 October 2026, in red (7 in the figure). The number of days overdue grows each day. The codes after each label (H-3, D-SD-2 and so on) are the field codes shown on screen for the AMLC GoTRACS report.
This step shows the reason codes the STR cites, as primary codes and as additional codes.
Figure 6.7 Step 3, Reason for suspicion: the reason codes (1) with SC 3 ticked (2), and Additional reason codes (3) with SC 3 shown dimmed (4)
Reason for suspicion codes D-SD-2 (required, *): "Select one or more SC, PC, or MC codes. Multiple selections allowed."
In STR 694, SC 3 is ticked.
Additional reason codes D-SD-5 (optional): "Secondary suspicion codes beyond primary codes from Step 3. Codes already selected as primary are shown dimmed." The same code lists repeat here.
SC 3 is shown dimmed in the additional list.
A filed STR shows no selection counter on this step.
Each section has three groups, which scroll inside the dialog: Suspicious circumstances — SC1-SC6, Predicate crimes — PC1-PC36 and Transnational organized crime — MC1.
The description of every code, and which predicate-crime codes carry a KYC REQ tag, is listed once in Step 3: Reason for suspicion in Case Manager.
This step shows which of the case's transactions are included in the STR, their total amount, and the role of each party in them.
Figure 6.8 Step 4, Transaction: filters (1), Selected 3 (2), total amount Mixed 627,513.17 (3), Select Suspicious Transactions (4) and the Party Role legend (5)
Filters: Type (All type), Period From and Period To (dd/mm/yyyy).
Selected: the number of transactions included (3).
total amount (D-TD-6): the total of the included transactions. When they are in different currencies it is labelled Mixed (here Mixed 627,513.17).
Select Suspicious Transactions (required, *): "Triggered transactions for this case. All are selected by default - deselect any you want to exclude from the STR".
The party-role letters next to each sender and receiver (S, B, C, T, O) are explained in the Party Role table in Step 4: Transaction.
The note below the legend reads: "MOT, Product Type, Purpose of Remittance, and Transaction Code are sourced from ingested data and included automatically in the Format X CSV per selected transaction. Total amount can be manually overridden below."
This step shows the parties named in the STR and their identity details. It lists the parties under the heading Subject parties: "Auto-derived from selected transactions. Click a row to expand and edit." Each party row shows a tag (AH), the name in the form Last, First (or Last, First, Middle) and the customer ID. Click a row to expand it.
Figure 6.9 Step 5, Subject parties: Sinha, Harish expanded (1), Party role (2), Account holder (3), Entity (4), IDENTITY (5), ID DOCUMENTS (6) and ADDITIONAL DETAILS (7)
The party row: Sinha, Harish. The arrow at the right collapses the row.
Party role: S - Subject of Suspicion.
Account holder check box, labelled "(emits A-block in CSV)": ticked.
Entity D-A-3: N - Natural Person.
IDENTITY fields.
ID DOCUMENTS fields.
ADDITIONAL DETAILS fields, below the visible area (scroll the dialog).
Group
Field (code)
Value or placeholder in STR 694
IDENTITY
Last name D-A-4a
Sinha
IDENTITY
First name D-A-4b
Harish
IDENTITY
Middle name D-A-4c
empty (placeholder "e.g. Salamanca")
IDENTITY
CRN D-A-2
TEM-CUST-10L847
IDENTITY
Account no. D-A-8
empty (placeholder "e.g. 1238444223")
ID DOCUMENTS
ID type D-A-12
Others (drop-down)
ID DOCUMENTS
ID number D-A-13
empty (placeholder "e.g. 045223411")
ID DOCUMENTS
Date of birth D-A-4c
a date (hidden in the figure)
ID DOCUMENTS
Nationality D-A-11
empty (placeholder "e.g. PH")
ADDITIONAL DETAILS
Complete address D-A-5
not visible in the capture
ADDITIONAL DETAILS
Country code D-A-6
PH - Philippines
ADDITIONAL DETAILS
ID City code — PSGC D-A-7
not visible in the capture
ADDITIONAL DETAILS
Place of birth D-A-10
not visible in the capture
ADDITIONAL DETAILS
Source of fund D-A-6
Employed
ADDITIONAL DETAILS
Contact no. D-A-15
not visible in the capture
ADDITIONAL DETAILS
Old account no. D-A-16
not visible in the capture
For each field's required marker and placeholder, see Step 5: Subject parties in Case Manager.
STR 694 lists 11 parties: Sinha, Harish; Banerjee, Leena; Agarwal, Girish; Dubey, Kunal; Mishra, Smita; Villacorta, Rodolfo, Aguilar; Halili, Cristina, Garcia; Domingo, Benedict, Abella; Valdez, Ella, Fajardo; Singh, Aman; Joshi, Neha. These are the parties behind the +8 tag in the register's Subjects column (three names shown plus eight more).
Read this if you want to file a new STR. STR Listing has no button to create an STR. An STR is filed from a case in Case Manager, using the same six steps shown above; see that chapter for how to file one, and Diagram 6.1 at the top of this chapter for the path an STR takes. A case whose STR has been filed shows the status STR Created, as in Figure 5.12. To see the STRs linked to one customer, open the customer's STR History tab in Customer 360.
Name Screening checks names against the watchlist. Analysts use it to look up watchlist records and to screen a single name by hand. Compliance administrators use it to follow the batch and delta screening runs and to set the alert bands and field weightages that screening uses.
For
Analysts and administrators
In the menu
Fyscal ARCX → Name Screening
Reading time
About 24 min
Watchlist Search: look up watchlist records by name and narrow them with filters.
Use Watchlist Search to look up records on the watchlist by name, narrow them with filters and open any record's details. The table stays empty until you search.
Figure 7.1 Watchlist Search before a search: Search by Name (1), Refresh and Hide Filters (2), the five filters (3), the results columns (4) and the empty state (5)
Search by Name: type the name of the person or entity to look up.
Refresh reloads the results. Hide Filters hides the filter row, which is shown when the page opens.
The filters: Country, PEP Status, Category, Entity and Source. Each one is set to All by default.
The results table, with the columns UID, Name, PEP Status, Country, Category and Date of Birth.
The empty state, Oops! No data available with the line "Please adjust your search criteria or try again later", which shows until a search returns records.
Filters
Each filter opens a list with a search box at the top, so you can type to find an option.
Filter
Options
Country
Default All. Choose a country.
PEP Status
Active, NON-PEP, Unknown
Category
WEBSITE, MILITARY, AIRCRAFT, VESSEL, BANK, POLITICAL INDIVIDUAL, SHELL BANK OR COMPANY, RELIGION, CRIME - ORGANIZED, CRIME - TERROR, EMBARGO, POLITICAL PARTY, EMBARGO VESSEL, TRADE UNION, PORT, CRIME - FINANCIAL, ORGANISATION, CORPORATE, EMBARGO AIRCRAFT, INDIVIDUAL, COUNTRY, DIPLOMAT, CRIME - WAR, CRIME - OTHER, ADDRESS, CRIME - NARCOTICS, SPECIAL JURISDICTION, LEGAL
Entity
Male, Female, Entity, Unknown
Source
All, Internal Watchlist, LSEG
Results columns
Column
What it shows
UID
The record's identifier on the watchlist, for example 3601955. A record marked deleted shows a red Deleted label and a date (for example 15/04/2026) under its UID.
Name
The name as held on the watchlist, for example John SMITH.
PEP Status
A green PEP chip, a red NON-PEP chip, or - when the record has no PEP status.
Country
The record's country, for example UNITED KINGDOM.
Category
The record's category, for example INDIVIDUAL, LEGAL or CRIME - NARCOTICS.
Date of Birth
The date of birth in YYYY/MM/DD format, or - when the record has none.
Source
The list the record comes from, for example LSEG. This column appears once results are shown.
Step 1Search by name
Type the name in Search by Name, for example John Smith. The table fills with matching records and a Name: John Smith tag appears under the filters. A common name returns many records: this search returns 20, and the footer reads Showing 20 results.
Step 2Narrow the results with a filter
Click a filter, for example PEP Status (1), and choose an option from the list (3). You can type in the list's search box (2) to find an option.
Figure 7.2 The PEP Status filter (1) open: the search box (2) and the options Active, NON-PEP and Unknown (3)
Step 3Read the results
Compare UID, PEP Status, Country, Category and Date of Birth to tell records with the same name apart (dates of birth are hidden in the figure). Use the arrows at the bottom right to move between pages.
Figure 7.3 Results for John Smith: the Name tag and RESET FILTERS (1), the Source column (2), a record marked Deleted with its date (3) and the result count (4); dates of birth hidden
Step 4Clear the search
Click the × on the Name tag to remove that one filter, or click RESET FILTERS to clear them all.
Fyscal ARCX→Name Screening→Watchlist Search→a result row
Open a record's details when you need more than the results table shows: its identity, risk background, network and sources. Click a row in the results to open the Watchlist Entity Details dialog for that record. The dialog's heading is the entity name. Below it, two summary cards show Entity Name, UID, PEP Status and Category. These cards stay in place while you move between the four tabs: Profile & Identity, Risk & Background, Network & Locations and Source. A field shows -- when the record has no value for it. Click × at the top right to close the dialog.
The figures below show record 3601955, JOHN SMITH, with PEP Status PEP and Category LEGAL. Third-party details from the watchlist (date and place of birth, address, associates, biography, identification, reports and source links) are hidden in the figures.
Tab
Fields
Profile & Identity
Gender/Type, Date of Birth, Place of Birth, Citizenship, Alternative Spelling, Age, Identification Number, Aliases, IDs / Passports, Deceased Date
Risk & Background
Position, PEP History, Title, Category, Sub-Category, Special Interests, PEP Status, and a Further Information/Biography panel. In this record the panel is split into BIOGRAPHY, IDENTIFICATION and REPORTS.
Network & Locations
Addresses, Associates (shown as UIDs in blue), Companies
Source
Links: the source websites for the record, each shown as a link chip.
Figure 7.4 Profile & Identity tab: the entity name (1), the summary cards (2), the four tabs (3), the left column of identity fields (4) and the right column (5)Figure 7.5 Risk & Background tab: the tabs (1), Position, PEP History, Title and Category (2), Sub-Category, Special Interests and PEP Status (3), and the Further Information/Biography panel (4)Figure 7.6 Network & Locations tab: the tabs (1), Addresses (2), Associates (3) and Companies (4)Figure 7.7 Source tab: the tabs (1), the Links (2) and the close button (3)
Use Manual Screening to screen one person or company by entering their details yourself. Next to each field the form shows the weightage it carries, taken from the active Screening Configuration.
Figure 7.8 The Manual Screening form, empty: the configuration chips (1), the weightage bar (2), Personal Details (3), Date of birth & Citizenship (4), Address (5), and Reset and Proceed to screen (6)
Two chips: Config version ID : 1791441937 and Rule version : v2.1.0. The config version ID is the same number as the ACTIVE version on the Screening Configuration page.
The weightage bar: Total Weightage: 100%, split as Name: 65%, Address: 10%, Citizenship: 10%, Gender: 10% and DOB: 5%.
Personal Details: Customer Name, Entity Type and Gender.
Date of birth & Citizenship: Date of Birth and Citizenship.
Address: Street, City, Province/Region and Address Country. The section carries a single weightage of 10%.
Reset and Proceed to screen.
Field
Weightage shown
Required
Options or format
Customer Name
65%
Yes (*)
Free text. Placeholder "Enter Name".
Entity Type
None
No
Placeholder "Select Entity Type". Options Individual and Company.
Gender
10%
No
Placeholder "Select Gender". Options Male, Female and Other.
Date of Birth
5%
No
Placeholder "Select Date". A calendar with month and year selectors. Years run from 1926 to 2026, and dates after today are greyed out.
Citizenship
10%
No
Free text. Placeholder "Enter Citizenship".
Street
10% for the whole Address section
No
Free text. Placeholder "Enter Street".
City
No
Free text. Placeholder "Enter City".
Province/Region
No
Free text. Placeholder "Enter Province/Region".
Address Country
No
Free text. Placeholder "Enter Address Country".
Step 1Enter the name
Type the customer's name in Customer Name. This is the only field marked as required (*).
Step 2Choose the entity type
Open Entity Type (1) and choose Individual or Company (2).
Figure 7.9 The Entity Type field (1) and its list (2): Individual and Company
Step 3Choose the gender
Open Gender and choose Male, Female or Other.
Step 4Pick the date of birth
Click Date of Birth. In the calendar, choose the month and year from the two lists at the top (2), or move with the arrows (1, 3), then click the day. Today's date is highlighted (4) and dates after it are greyed out.
Figure 7.10 The Date of Birth calendar: previous month (1), the month and year lists (2), next month (3) and today's date (4); dates after today are greyed out
Step 5Add citizenship and address
Type Citizenship, then fill in whichever address fields you have: Street, City, Province/Region and Address Country.
Step 6Screen, or start again
Click Proceed to screen to run the screening. To clear the form instead, click Reset.
Use Batch Screening to check whether batch runs succeeded and how many alerts they created. Batch Screening lists the batch screening runs. For each run it shows how many customers were scanned, how many alerts were created, and the run's status and duration. The page has no Change Schedule button, and clicking a row does not open a detail view.
Figure 7.11 Batch Screening: the schedule card (1), Run Date (2), Status (3), Refresh (4), the Customers Scanned figure (5), the run ID (6) and the record count (7)
The schedule card. Here it reads Inactive, Current Frequency: Daily at 09:00, Next Run: - and Last Run: -.
Run Date: a date-range field ("Pick a date range").
Status: the status filter, set to All Status by default.
Refresh reloads the table.
The Customers Scanned figure, shown underlined in blue.
The run ID, with a copy icon next to it.
The record count, for example Showing 1-13 of 13, with the page controls on the right.
Column
What it shows
Run Date / ID
The run's date and time (for example 14 Oct, 03:41:36 PM) and, below it, RUN ID: with the run number and a copy icon.
Customers Scanned
The number of customers the run screened.
Alerts Created
The number of alerts the run created.
Errors
The number of errors in the run.
Watchlist Count
The number of watchlist records at the time of the run, for example 6,855,187.
Status
The run's status. See the table below.
Duration
How long the run took, for example 10s, 5m or 1h 11m, or - when no duration is recorded.
Status
Meaning
Screening In Progress
The run has not finished yet.
Screening Success
The run completed successfully.
Screening Failed
The run failed.
Step 1Filter runs by status
Click Status (1) and choose Screening In Progress, Screening Success or Screening Failed (3). You can type in the list's search box (2) to find a status.
Figure 7.12 The Batch Screening Status filter (1) open: the search box (2) and the options Screening In Progress, Screening Success and Screening Failed (3)
Step 2Filter runs by date
Click Run Date ("Pick a date range") and choose the first and last day of the period.
Use Delta Screening to follow the delta runs and to change when they run. Delta Screening shows the delta screening schedule and lists its runs, including the next scheduled run. Unlike Batch Screening, this page has Resume and Change Schedule buttons.
Figure 7.13 Delta Screening: the schedule bar (1), Resume (2), Change Schedule (3), Status (4), Date Range (5), the Upcoming run (6) and Refresh (7)
The schedule bar. Here it reads Inactive, Current Frequency: Daily at 05:00, Next Run: 08 Oct 2026, 05:00 and Last Run: 23 Sep 2026, 12:01. On 14 October the Next Run date shown had already passed, and the Upcoming row still showed it.
Resume: a button on the schedule bar.
Change Schedule opens the Change Screening Schedule dialog.
Status: the status filter, set to All Status by default.
Date Range: a date-range field ("Range").
The next scheduled run, labelled Upcoming with the status Scheduled. Its other columns show —.
Refresh reloads the table.
The two screening pages differ as follows:
On the page
Batch Screening
Delta Screening
Schedule with Current Frequency, Next Run and Last Run
Yes
Yes
Resume button
No
Yes
Change Schedule button
No
Yes
Errors column
Yes
No
Next run listed as Upcoming
No
Yes
The Watchlist Count also differs in size: 6,792,763 on the batch runs of 05 Oct, and 12,396 on the delta runs of 23 Sep.
Column
What it shows
Run Date / ID
The run's date and time (for example 23 Sep 2026, 10:52) and, below it, Run ID with the run number and a copy icon. The next scheduled run shows Upcoming in place of the ID.
Customers Scanned
The number of customers the run screened.
Alerts Created
The number of alerts the run created.
Watchlist Count
The watchlist count recorded for the run, for example 12,396.
Status
The run's status. See the table below.
Duration
How long the run took, for example 1h 8m 43s.
The table shows 20 runs per page (Showing 1-20 of 30, Page 1 of 2).
Status
Meaning
Scheduled
The next run, not yet started (the Upcoming row).
In Progress
The run has not finished yet.
Completed
The run finished.
Failed
The run failed.
Paused
A status offered by the filter.
Step 1Filter runs by status
Click Status (1) and choose All Status, Scheduled, In Progress, Completed, Failed or Paused (3). A tick marks the current choice (2).
Figure 7.14 The Delta Screening Status filter (1): All Status ticked (2), then Scheduled, In Progress, Completed, Failed and Paused (3)
Step 2Filter runs by date
Click Date Range. A two-month calendar opens. Click the first and last day of the period, then click Apply. Clear removes the range.
Step 3Open Change Schedule
Click Change Schedule. The Change Screening Schedule dialog opens, headed "Select the new frequency and run time, add a reason, then review before confirming."
Figure 7.15 The Change Screening Schedule dialog: the current schedule (1), New Frequency (2), Run Time - UTC (3), Reason (4), Next Run Preview (5), and Cancel and Review Changes (6)
Area or field
What it shows or expects
1. Current schedule
Current Frequency: Daily at 05:00 UTC, followed by "Any schedule change — whether frequency or time — takes effect after the next scheduled run on Thu, 08 Oct 2026 at 05:00 UTC."
2. New Frequency
A list. Here it shows Daily.
3. Run Time - UTC
A list of times in UTC. Here it shows 05:00 AM.
4. Reason
Free text. Placeholder "Describe why the schedule is changing."
5. Next Run Preview
The next run and a summary of the schedule, for example Thu, 08 Oct 2026 at 05:00 UTC and "Runs every day at 05:00 UTC."
6. Buttons
Cancel and Review Changes. × at the top right also closes the dialog.
Step 4Set the new schedule
Choose the New Frequency and the Run Time. Type the Reason for the change. Check the Next Run Preview, then click Review Changes. To leave without changing anything, click Cancel.
Use Alert Configuration to review or change the alert bands that screening uses. Each band has a name, a colour, a Min % to Max % range, a No Alert setting, an SLA Deadline and an Auto Hibernate setting. The page has two tabs: Active Alert Configuration and Alert Configuration History.
Figure 7.16 Active Alert Configuration: the tabs (1), the version details (2), Edit (3) and the bands table (4)
The tabs Active Alert Configuration and Alert Configuration History.
The active version: Version (for example 6acdb8b7955aaed16603eea5), Created At (13 Oct 2026, 10:21:03 (+05:30)) and Created By (hidden in the figure).
Edit switches the table into the edit form.
The bands table.
Column
What it shows
Name
The band's name.
Color
The band's colour, as a swatch and a hex code.
Min %
The lower end of the band's range.
Max %
The upper end of the band's range.
No Alert
Yes or No.
SLA Deadline
The SLA as days, hours and minutes (for example 3d 0h 0m), or — where No Alert is Yes.
Auto Hibernate
Yes or No, or - where No Alert is Yes.
The active configuration in Figure 7.16 (saved on 13 Oct 2026):
Name
Color
Min %
Max %
No Alert
SLA Deadline
Auto Hibernate
very low
#C4C5C4
0%
85%
Yes
—
-
Low
#3CAF49
85%
90%
No
3d 0h 0m
No
Medium
#F59F66
90%
95%
No
5d 0h 0m
No
HIGH
#FB5050
95%
100%
No
3d 0h 0m
No
The SLA does not rise with the band in this configuration: Medium has 5 days, while Low and HIGH have 3 days each. The values are set per band, so check them when you change the bands.
A Name Screening alert shows its band and percentage in its header, for example LOW 84.29% on ALT-NS-05102026-000115, and the same band on each match candidate (see Alert Details: Name Screening). The header also shows Config: with an Alert Configuration version ID. On that alert it is 6ab3c6efe9d518f3fc6b21d9. That version is not among the 10 listed in Alert Configuration History on 14 October 2026. The alert still shows LOW 84.29%, although 84.29% falls in the current very low band (0% to 85%).
Edit the alert configuration
Figure 7.17 Alert Configuration in edit mode: Cancel and Save (1), the No Alert switch (2), Min % and Max % (3), the SLA Deadline fields (4), the delete icons (5) and Add More Threshold (6)
Cancel and Save take the place of Edit.
No Alert is a switch, shown on for the very low band.
Min % and Max % are number fields. The first band's Min % (0) and the last band's Max % (100) are greyed out.
SLA Deadline has three fields: DD, HH and MM. On the band with No Alert switched on, these fields and the Auto Hibernate switch are greyed out.
A red delete icon appears at the end of the Medium and HIGH rows.
Add More Threshold adds a band.
Step 1Open the edit form
On the Active Alert Configuration tab, click Edit.
Step 2Change the bands
For each band, set the Name, the Color, Min % and Max %, the No Alert switch, the SLA Deadline (DD : HH : MM) and the Auto Hibernate switch. Click Add More Threshold to add a band, or a band's delete icon to remove it.
Step 3Save or cancel
Click Save to keep your changes, or Cancel to discard them.
Alert Configuration History
Open the Alert Configuration History tab to see every saved version. The table has the columns Config Version ID (with a copy icon), Status, Created and Created by. One version is ACTIVE and the rest are INACTIVE. In Figure 7.18 there are 10 versions (Showing 1-10 of 10), newest first.
Figure 7.18 Alert Configuration History: the tab (1), the columns (2) and the ACTIVE version (3), followed by nine INACTIVE versions; names hidden
Use Screening Configuration to review or change how much weight each field and sub-field carries in screening. Screening Configuration holds the weightages of the screening fields and of their sub-fields. The Manual Screening form shows the active version's ID and weightages. The page has two tabs: Active Configuration and Configuration History.
Figure 7.19 Active Configuration: the tabs (1), the version details (2), Edit (3), the Total Weightage bar (4), a field card with sub-fields, Address (5), and a field with no sub-fields, Citizenship (6)
The tabs Active Configuration and Configuration History.
The active version: Created At (08 Oct 2026, 12:15:37 (+05:30)), Created By (hidden in the figure), Config version (1791441937) and StatusACTIVE.
Edit switches the page into the edit form.
Total Weightage: 100%: a bar showing each field's share in its own colour.
A field card. Address, Name and DOB have a chevron and list their sub-fields below.
Country 60%, City 15%, Street Address 15%, Region 10%
Citizenship
10%
None
Gender
10%
None
DOB
5%
Year 50%, Month 40%, Day 10%
In this configuration, the field weightages add up to 100%. Within each of Address, Name and DOB, the sub-field weightages also add up to 100%.
Edit the screening configuration
Figure 7.20 Screening Configuration in edit mode: Cancel and Save (1), a field's weightage field, Address (2), and a sub-field's weightage field, Country (3)
Cancel and Save take the place of Edit.
Each field's weightage becomes a number field with a % sign.
Each sub-field's weightage becomes a number field too.
Step 1Open the edit form
On the Active Configuration tab, click Edit.
Step 2Change the weightages
Type the new percentages for Address, Name, Citizenship, Gender and DOB, and for the sub-fields of Address (Country, City, Street Address, Region), Name (Fuzzy, Phonetic) and DOB (Year, Month, Day).
Step 3Save or cancel
Click Save to keep your changes, or Cancel to discard them.
Configuration History
Open the Configuration History tab to see every saved version. The table has the columns Config Version ID (with a copy icon), Status (ACTIVE or INACTIVE), Created and Created by, newest first. The example environment holds 105 versions, 20 per page (Showing 1-20 of 105, Page 1 of 6).
Figure 7.21 Configuration History: the tab (1), the columns (2) and the ACTIVE version 1791441937 (3), followed by INACTIVE versions; names hidden
A Rationale Code and Rationale Details (at least 10 characters)
Screening finds watchlist records that may be your customer. The analyst decides whether each one is. The Matches panel puts the customer's values next to each watchlist candidate's values, field by field, with a Weightage and a Score for each field and a band and percentage for the candidate. The panel is described in Customer, accounts and matches, and the decision is recorded with Dispose Alert (see Dispose alerts and close a case).
What the dispositions mean for you
The Disposition list offers three values. The screen does not define them; the table gives their usual meaning in screening review. Your institution's procedures set what each one requires.
Disposition
Usual meaning in screening review
True Match
The watchlist record is your customer: the name matches and the other identifiers agree. In the examples, a Closed case with this disposition shows File STR (see File an STR).
False Match
The watchlist record is someone else: the names are only alike, or an identifier such as date of birth or nationality clearly conflicts.
Potential Match
The record may be your customer, but the evidence is not enough to confirm or rule it out, for example because the record has no date of birth.
Decide on a match
Is the watchlist name the customer's name, allowing for spelling variants, transliteration and word order?
Yes
Do date of birth, nationality, ID number and address agree?
They agree
True Match
One clearly conflicts
False Match
Missing or unclear
Potential Match
No
False Match
Diagram 7.2 — Deciding a name-screening match
Diagram 7.2 is a general review aid, not product logic. Start with the name. If it is not the customer's name, the candidate is a False Match. If it is, compare the secondary identifiers. Agreement points to a True Match and a clear conflict to a False Match. When identifiers are missing on either side, look for more evidence in the Identity and Additional Information tabs, such as aliases and ID numbers, before you settle on Potential Match.
Example: reading a candidate
Alert ALT-NS-05102026-000115 for Ramon Michael Castillo Tan is banded LOW 84.29% and has two candidates (see Alert Details: Name Screening). The first candidate, UID 4880431, shows:
Field
Customer
Candidate (UID 4880431)
Weightage
Score
Name
Ramon Michael Castillo Tan
MICHAEL TAN
73%
90%
Nationality
Philippines
PHILIPPINES
11%
100%
Date of Birth
Provided
-
0%
0%
Address
Provided
A different city
12%
27%
Entity Type
INDIVIDUAL (MALE)
M (M)
0%
0%
Read with Diagram 7.2: the name is close and the nationality agrees, but the record has no date of birth to compare and the address is in a different city. The identifiers are partly missing and partly different, so this candidate cannot be confirmed from the Matches panel alone. The second candidate, RAMON TAN (UID 7134045, LOW 82.6%), needs the same review. The alert in the example is Not Started and has no disposition yet.
Transaction Monitoring is where you build and run the rules that scan transactions for suspicious patterns. A rule is called a typology; it is made of conditions on reusable calculations called variables, and it runs on a schedule. Compliance analysts and rule owners use the three pages under the menu: Typology, Variables and Schedules.
For
Compliance analysts and rule owners
In the menu
Fyscal ARCX → Transaction Monitoring
Reading time
About 43 min
The main example in this chapter is the typology High volume and Value outgoing Remittances (TMR-01072026-000463). For ready-made rules you can build with the same screens, see the Typology Library.
The Transaction Monitoring Typologies page lists every typology (rule) with its status and category. Start here to find a rule, open it, or create a new one.
Figure 8.1 The typology list searched for Remittance: search (1), Refresh (2), Show Filters (3), + New (4), a rule and its ID (5), status chips (6), typology type (7), the row menu (8) and the count (9)
Search by rule name and id: type part of a rule name or a rule ID such as TMR-01072026-000463. Here “Remittance” finds 8 rules.
Refresh: reloads the list.
Show Filters: opens the filter bar (the button then reads Hide Filters). See Filter and sort the list.
The filter bar has two filters and a sort control.
Step 1Open the filter bar
Click Show Filters. Three controls appear below the search box: All Typologies (1), All Statuses (2) and Sort By (3). The button now reads Hide Filters (4).
Figure 8.2 The filter bar: All Typologies (1), All Statuses (2) and Sort By (3), with Hide Filters (4)
Step 2Filter by typology type
Open All Typologies (1) and choose a type from the list (2). The list shows the types in use, for example SMURFING, Mule Networks, Layering, High Value, High Value Transfer, Support, Structuring and identical transactions; some names appear twice because two types were created with the same name. Scroll the list with the arrow at the bottom (3) for more, such as Anomaly, Cardinality, Large Transaction and Velocity.
Figure 8.3 All Typologies (1) open: the list of typology types (2) and the scroll arrow (3)
Step 3Filter by status
Open All Statuses (1) and choose Draft, Published or Shadow from the list (2). Choose All Statuses to clear the filter.
Figure 8.4 All Statuses (1) open: All Statuses, Draft, Published and Shadow (2)
Step 4Sort the list
Open Sort By and choose Newest First (the default) or Oldest First.
Step 5Use the row menu
Click ⋮ (2) in the Actions column. On a Draft rule (1) the Actions menu offers Duplicate (3), which makes a copy of the rule.
Figure 8.5 The Actions menu (2) on a Draft rule (1): Duplicate (3)
Fyscal ARCX→Transaction Monitoring→Typology→(click a row)
Click a row to open the typology's page. It shows the rule read-only: its status, timing, condition groups and the variables it uses. The example below is a Published rule that is currently Paused.
Figure 8.6 Typology detail for High volume and Value outgoing Remittances (TMR-01072026-000463): Published, Paused, three condition groups and six variables
Status chips (Published, Paused), the rule ID with a copy icon, and the description (here “No description provided.”).
Page actions: Schedule Details (the rule's run history, see Schedule Details), Duplicate Typology, Resume (shown because the rule is paused) and Timeline & Notes.
A condition group, with its number of conditions (2 conditions). Each row reads WHEN variable, operator, value.
AND — all must match: the link between conditions inside a group.
OR — any one matches: the link between groups.
VARIABLES with a count (6): one card per variable, showing its type, WINDOW and GROUP.
The three groups of the example read as follows. The rule alerts on a sender when any one group is fully true.
Group
Condition 1
Condition 2
1
outgoing remittance 1 day vol Greater Than Equal (>=) 5
AND
outgoing remittance 1 day sum Greater Than Equal (>=) 10000
2
outgoing remittance 14 day vol Greater Than Equal (>=) 5
AND
outgoing remittance 14 day sum Greater Than Equal (>=) 20000
3
outgoing remittance 30 day vol Greater Than Equal (>=) 14
AND
outgoing remittance 30 day sum Greater Than Equal (>=) 50000
Variable
Type
WINDOW
GROUP
outgoing remittance 30 day sum
Num_agg_sum
in last 30 day
sender_entity_id
outgoing remittance 30 day vol
Str_agg_count_distinct
in last 30 day
sender_entity_id
outgoing remittance 14 day sum
Num_agg_sum
in last 14 day
sender_entity_id
outgoing remittance 14 day vol
Str_agg_count_distinct
in last 14 day
sender_entity_id
outgoing remittance 1 day sum
Num_agg_sum
in last 1 day
sender_entity_id
outgoing remittance 1 day vol
Str_agg_count_distinct
in last 1 day
sender_entity_id
Step 1See how a variable is calculated
Click a variable card. A popup shows the variable's name, its type (1), a DESCRIPTION (2) of the calculation, its WINDOW (3) and its GROUP (4). For outgoing remittance 30 day sum the description reads NUM_AGG_SUM(amount), type STR_EQ REMITTANCE, grouped by sender_entity_id, window: (now() - INTERVAL 30 DAY, now()): the sum of amount for transactions whose type equals REMITTANCE, per sender, over the last 30 days. Click × (5) to close.
Figure 8.7 Variable popup for outgoing remittance 30 day sum: type (1), description (2), window (3), group (4) and close (5)
Step 2Read or add notes
Click Timeline & Notes. The Activity Timeline panel opens with the rule ID, an ADD A NOTE box (1), Attach File (2) and Add note (3). Events for the rule are listed below (4); for this rule the panel shows No activity found. Click × (5) to close.
Figure 8.8 Activity Timeline for TMR-01072026-000463: note box (1), Attach File (2), Add note (3), events (4) and close (5)
+ New opens Create Typology. The first page holds the rule's details and its conditions; Next Step goes to the schedule page (Part 5 of the walkthrough).
Figure 8.10 Create Typology, first page: details, Combine groups with, Group 1 and its first condition row
+ Variable: creates a variable without leaving the form (opens Create Variables).
Typology Name (required).
Typology type (optional).
Suppression Window: a number and a unit.
Description.
Combine groups with: AND or OR.
Match: AND or OR for the conditions inside this group.
A condition row: WHEN, field, operator, value type and value.
Add Condition: adds a row to this group.
Add Group: adds another group.
Cancel and Next Step. Next Step stays greyed out until the required details and conditions are complete.
Field
What it expects
Required
Options or format
Typology Name
The rule's name as it will appear in the list
Yes (*)
Free text
Typology type
The category the rule is filed under; it is what the All Typologies filter uses
No (optional)
Select typology type; each type shows a short code, for example Structuring (TP100), Anomaly (TP103), Large Transaction (LT-01). The chosen type shows as a chip with ×.
Suppression Window
A time period set on the rule. An information icon (ⓘ) next to the label holds the field's help text.
No
A number (default 0) and a unit (default Hour; Day is also used, for example 30 Day)
Description
What the rule monitors and why
No
Free text; placeholder “Describe what this rule is monitoring and why”
Combine groups with
How groups combine
—
AND (default) or OR
Group Match
How conditions inside the group combine
—
AND (default) or OR
WHEN field
The variable to test
Yes
Select field: lists your variables
Operator
The comparison
Yes
Select operator (greyed until a field is chosen). Twelve operators, from Equal to Is Not Null; the full list is in the Part 3 field reference.
Value type
What the field is compared with
Yes
Static Value (default) or Variable; a third entry, Ingested Data, is shown greyed out
Value
The threshold
Yes
With Static Value: a number in Enter value. With Variable: a variable picker and a THAN MULTIPLIER box.
With Variable as the value type, the condition compares two variables, scaled by the multiplier. For example, in Rule 9 of the Typology Library the condition sent_sum_7d_spikeGreater Than Equal (>=) Variable sent_sum_90d with THAN MULTIPLIER 0.5 means “the 7-day total is at least 0.5 × the 90-day total”. The rule page shows the compared variable as “sent_sum_90d (multiplied by 0.5)”.
When a group has more than one condition, the form shows AND — all must match or OR — any one matches between rows, following the group's Match setting. The same labels appear between groups, following Combine groups with. Each extra group has a Remove button and each extra row an ×. A worked example is in How conditions are evaluated.
A variable is a named calculation, such as the number of transactions a sender made in the last 7 days. Typology conditions test variables, and one variable can be used by many typologies. The Variables page lists them all.
Figure 8.11 The Variables list searched for sender_txn: search (1), Refresh (2), Show Filters (3), + New (4), a variable name (5) and ID (6), and the count (7)
Search box (variable name). Here “sender_txn” finds 21 variables; the search also shows as a Search: chip with RESET FILTERS below the box.
Refresh.
Show Filters.
+ New: opens Create Variables.
Variable Name / Variable ID: the name, for example sender_txn_sum_365d, and its ID, for example VAR-06102026-000735.
The Variable ID chip, with a copy icon.
Pagination (Showing 1-10 of 21, Page 1 of 3).
Column
What it shows
Variable Name / Variable ID
Name and VAR- identifier
Created
Date and time created
Updated
Date and time last changed
Variable names in the product follow a pattern of subject, measure and window, for example sender_txn_count_7d, sender_txn_sum_90d, sender_txn_max_amount_7d, sender_txn_avg_amount_5d. Use the same pattern so variables are easy to find and reuse.
Step 1Sort the list
Click Show Filters. A single Sort By control (1) appears (placeholder Select Sort By), and the button reads Hide Filters (2).
Figure 8.12 Variables with filters shown: Sort By (1) and Hide Filters (2)
Fyscal ARCX→Transaction Monitoring→Variables→(click a row)
Click a variable to open View Variable. It shows the variable's definition and every rule that uses it.
Figure 8.13 View Variable for sender_txn_count_7d (NUM_AGG_COUNT): used in two rules, so it cannot be edited
The variable type tag, here NUM_AGG_COUNT.
CREATED and UPDATED, with date, time and user.
Used in: each typology that uses the variable, as a link. Here: Banking- Structured Transactions 3K to 5K (1 Week), and the walkthrough's rule GUIDE EXAMPLE - Velocity (see Build a typology from scratch).
Note: “Variables that are already live in existing rules cannot be edited”.
Edit, Delete and Duplicate. For this variable Edit and Delete are greyed out; Duplicate is available.
Transaction / Entity.
Aggregation: Field (amount), Function (Count), Group by (sender_entity_id).
Time Window (scroll down for the window and Filters).
Fyscal ARCX→Transaction Monitoring→Variables→+ New
+ New on the Variables page, or + Variable on Create Typology, opens Create Variables.
Figure 8.14 Create Variables: the empty form, with Select an existing variable on the left and Configure Variable on the right
Select an existing variable: pick a variable that already exists instead of creating a duplicate.
Transaction / Entity: whether the calculation is on transactions or entity data.
Variable name (required; placeholder “e.g. total_outgoing”).
Description (optional internal note).
Aggregation: Field, Function and Group by, all required.
Time Window, with Filters below it.
Save Variable.
Field
What it expects
Required
Options or format
Transaction / Entity
Data the variable is calculated from
—
Two tabs; Transaction is selected by default
Variable name
Unique name
Yes (*)
Free text, for example sender_txn_sum_90d
Description
Internal note
No
Free text
Field
The data field to calculate on
Yes (*)
Dropdown (placeholder Field/amount), for example amount, receiver_amount
Function
The calculation
Yes (*)
Depends on the field. A numeric field such as amount offers Count, Count Distinct, Sum, Average, Minimum, Maximum. An ID or text field such as id or receiver_entity_id offers only Count, Count Distinct, Minimum, Maximum. The variable's type tag follows the field and function, for example NUM_AGG_SUM, NUM_AGG_COUNT, STR_AGG_COUNT, STR_AGG_COUNT_DISTINCT.
Group by
Calculate separately for each value of this field
Yes (*)
Dropdown, for example sender_entity_id (one result per sender)
Time Window unit
Unit of the window
—
Hours, Days, Weeks, Months, Years
Analyze Transaction from … to … ago
Start and end of the window, counted back from the trigger time
—
Two number boxes followed by the unit and “ago”, for example from 90 to 0 Days ago
Filters (optional)
Restricts the calculation to matching transactions
No
Add Filter adds a row: Field, an operator (Select field first), a value, and Static or Dynamic. The heading counts the rows, for example Filters (1).
Below the window boxes the form draws a timeline labelled, for example, 0 days ago and Triggered at T (00:00), with the sentence “This variable will be triggered time 00:00:00 on day T.” The window is measured back from T. The second box is the end of the window: 0 ends the window at T, so from 90 to 0 Days ago is the last 90 days. The end can also be above 0: from 100 to 1 Days ago covers the 100 days up to one day before T, and the form's timeline then reads 1 day ago. The variable card on a typology page shows only the start (“in last 100 day”), so check the end on View Variable. The Typology Library's building blocks draw the windows side by side.
Filters are how a variable counts only some transactions. The variable outgoing remittance 30 day sum in the main example is a Sum of amount with a filter on type equal to REMITTANCE (its description reads type STR_EQ REMITTANCE).
Fyscal ARCX→Transaction Monitoring→Schedules→Run History
A schedule sets when rules run: a name, an execution interval, a start time and an optional end time. One schedule can drive several rules. The Schedules page has two views, Run History and Schedule List. Run History logs every run of every schedule.
Figure 8.15 Schedules, Run History view, with the Run Status filter open
View switch: Run History / Schedule List.
Search (Schedule Name, Schedule ID).
Run Status filter: All, Running, Completed, Partially Failed, Failed.
Sort By: Newest first by default.
Live Alerts: alerts raised by Published rules in the run.
Shadow Alerts: alerts raised by Shadow rules in the run (for example 504 for Every_Quarter, 19 for Migrated legacy schedule 297).
Fyscal ARCX→Transaction Monitoring→Schedules→Schedule List
Schedule List shows every schedule and how many rules use it. Schedules are created from the Create Typology schedule page (Part 5 of the walkthrough); this page has no create button.
Figure 8.16 Schedule List searched for Every: view switch (1), search (2), Sort By (3), Last Executed (4), Rules Linked (5) and Status (6)
View switch.
Search (Schedule Name). Here “Every” finds 12 schedules.
Sort By (shows All).
Last Executed: date and time of the last run, or — if it has not run.
Rules Linked: how many rules reference the schedule (Every_day: 22).
Status: Active, Inactive, or Completed once the schedule has passed its End Time.
Step 1Open a schedule
Click a row. The View dialog shows the schedule's ID (1), CREATED BY (2), Edit (3) and the Schedule fields (4): Name, Execution Interval (a number and a unit), Start Time and End Time (optional), followed by a summary sentence (5) such as “This rule will run every 1 day starting 07 Oct 2026, 12:00:00 am”. Live in: (6) names the active rule the schedule drives, or “Not used in any active rule”. Used in: (7) lists every rule that references it, each as a link.
Figure 8.17 View Every_day: ID (1), CREATED BY (2), Edit (3), schedule fields (4), summary (5), Live in (6) and Used in (7)
Step 2Edit a schedule
Click Edit (3) in the dialog to change the fields.
This walkthrough builds a complete rule, screen by screen, from a new variable to a saved draft. The worked example is a Velocity rule: flag a sender who makes 3 or more outgoing transactions totalling ₱5,000 or more within 7 days. Follow the parts in order; each step is one action, and the figure under it shows the screen after that action.
Create variablesField, Function, Group by, Time Window, Filters
Create TypologyDetails, then conditions in groups
Choose a scheduleExisting or + New; start in the future
Save as DraftStatus Draft; page becomes Update Typology
Dry RunCounts on past records; no alerts created
ActivateActivation Mode, then Submit Request
Diagram 8.1 — Building a typology, from variable to activation request
Diagram 8.1 shows the order the screens impose. A typology's conditions can only pick variables that already exist, so variables come first. Save as Draft needs a schedule, and Dry Run needs a saved draft. Activate does not switch the rule on: it sends a request to Maker Checker Approval (Diagram 8.2 in Part 7).
Before you open a form, write the rule down as variables and conditions. A variable calculates one number per sender; a condition compares that number with a threshold. The example needs two numbers per sender over the last 7 days: how many transactions they sent, and the total amount they sent.
Item
Value in the example
Where you set it
Count of transactions per sender, last 7 days
Variable sender_txn_count_7d: Fieldamount, Function Count, Group bysender_entity_id, window 7 days. It already exists, so it is reused.
New variable sender_txn_sum_7d: Fieldamount, Function Sum, Group bysender_entity_id, from 7 to 0 Days ago, no filters
Part 2
Condition 1
sender_txn_count_7dGreater Than Equal (>=) 3
Part 4
Condition 2
sender_txn_sum_7dGreater Than Equal (>=) 5000
Part 4
How the conditions combine
Both in Group 1, MatchAND (both must be true)
Part 4
Typology type
Velocity (V-01)
Part 3
Suppression Window
7 Day
Part 3
Schedule
Every 1 Day, starting at 09:00 AM on a future date, no end time
Part 5
Check for variables you can reuse before creating new ones: open Select an existing variable in Create Variables, or search the Variables list. Here the count variable exists and the 7-day sum does not, so Part 2 creates only the sum.
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open Create Variables
Go to Transaction Monitoring → Variables and click + New (1) at the top right.
Figure 8.18 + New (1), at the top right of the Variables page, opens Create Variables
Step 2Read the empty form
The Create Variables dialog opens. Select an existing variable (1) is on the left; Configure Variable is on the right, with Transaction / Entity (2), Variable name (3), Description (4), Field (5), Function (6), Group by (7) and Time Window (8) further down. Function stays greyed out until you choose a Field, and Save Variable (9) stays greyed out until the required fields are filled.
Figure 8.19 Create Variables, empty: Select an existing variable (1), Transaction / Entity (2), Variable name (3), Description (4), Field (5), Function (6), Group by (7), Time Window (8) and Save Variable (9)
Step 3Name and describe the variable
Leave Transaction (1) selected. In Variable name (2) type sender_txn_sum_7d. In Description (3) type a note such as “Total amount sent per sender over the last 7 days.”
Figure 8.20 Transaction selected (1), Variable name (2) and Description (3) filled in
Step 4Choose the Field
Open Field (1) (placeholder Field/amount). The list has a Search Fields box (2) and the 51 transaction fields. Choose amount (3).
Figure 8.21 The Field list (1) open: Search Fields (2) and amount (3) at the top
Step 5Choose the Function
With Field set to amount (1), open Function (2), now available. The options are Count, Count Distinct, Sum, Average, Minimum and Maximum. Choose Sum (3).
Figure 8.22 Field amount (1); the Function list (2): Count, Count Distinct, Sum (3), Average, Minimum, Maximum
Step 6Choose Group by
Open Group by (1). It lists the same fields as Field without amount. Type sender_entity in Search Fields (2): two fields remain, sender_entity_id and sender_entity_name. Choose sender_entity_id (3), so the sum is calculated separately for each sender.
Figure 8.23 Group by (1) searched for sender_entity (2): choose sender_entity_id (3)
Step 7Set the time window
Scroll down to Time Window. Click Days (1); the default is Hours. In Analyze Transaction from enter 7 and in to enter 0 (2). The line reads “from 7 to 0 Days ago”: the last 7 days up to the trigger time T. The form starts with one blank filter row under Filters (1) (3). Leave it empty: this variable sums every transaction the sender made. The blank row is dropped when you save.
Figure 8.24 Time Window: Days (1), from 7 to 0 Days ago (2); the blank filter row (3); Save Variable (4)
Step 8Save the variable
Click Save Variable (4 in Figure 8.24). The button shows Saving... and the fields grey out. The dialog then closes, and the new variable is the first row of the list with its ID, here VAR-07102026-000736. No confirmation message is shown. To find it again later, type its name in the search box (1): the row shows the name (2) and the Variable ID (3).
Figure 8.25 The saved variable found by name (1): its name (2) and Variable ID (3)
Step 9Check the saved variable
Click the row to open View Variable. The type tag (1) reads NUM_AGG_SUM, and the form shows amount, Sum and sender_entity_id. CREATED and UPDATED (2) show the date and time and the user. Edit, Delete and Duplicate (3) are at the top of Configure Variable; Update Variable (4) is greyed out. Scroll down (Figure 8.27): Days (1) is selected, the window reads 7 to 0 Days ago (2) and the heading reads Filters (0) (3). Close the dialog with ×.
Figure 8.26 View Variable for the new variable: type tag (1), created and updated (2), Edit, Delete and Duplicate (3), Update Variable (4)Figure 8.27 View Variable, lower part: Days (1), 7 to 0 Days ago (2) and Filters (0) (3)
Create Variables: field reference
Field
Required
What to enter / options
Select an existing variable
No
Opens a list of existing variables. Use it to check whether the calculation already exists.
Transaction / Entity
—
Two tabs. Transaction is selected by default. The example uses Transaction.
Free text; placeholder “Optional internal note”. It is shown on the variable card on the typology page (Figure 8.51).
Field
Yes (*)
A searchable list of 51 transaction fields (listed below). Example: amount.
Function
Yes (*)
Count, Count Distinct, Sum, Average, Minimum, Maximum. Greyed out until a Field is chosen. Example: Sum.
Group by
Yes (*)
A searchable list: the same fields as Field, without amount. Example: sender_entity_id.
Time Window unit
—
Buttons: Hours (default), Days, Weeks, Months, Years. Example: Days.
Analyze Transaction from … to … ago
—
Two numbers, counted back from the trigger time T. The empty form shows 10 and 0. Example: 7 and 0.
Filters (optional)
No
One blank row at the start: Field, an operator (Select field first), Enter value, and Static / Dynamic. Add Filter adds rows; the bin icon removes one. A blank row is not saved. Example: none.
Go to Transaction Monitoring → Typology and click + New (1).
Figure 8.28 + New (1), at the top right of the Typologies page, opens Create Typology
Step 2Read the details card
Create Typology opens on its first page. The top card holds Typology Name (2), Typology type (3), Suppression Window (4) and Description (5). + Variable (1) creates a variable without leaving the form. The conditions are below the card (Part 4). The page has no Save as Draft button: you save on the next page.
In Typology Name type Velocity 3 or more outgoing transactions totalling PHP 5000 in 7 days. A name may contain only letters, digits, spaces, hyphens, underscores and parentheses. Any other character turns the field red (1) with the message (2) “Rule name can only include letters, digits, spaces, hyphens, underscores, and parentheses”. The name in Figure 8.30 contains a colon, a plus sign, commas, an en dash and ₱, none of which is in that list. That is why the example name spells the amount as “PHP 5000”.
Figure 8.30 A name with characters outside the allowed set (1), and the validation message (2)
Step 4Open Typology type
Open Typology type (1) (marked optional). The list has a Search typology type box (2) and shows each type with its code (3): SMURFING (TP01), Mule Networks (ML01), Layering (LA01), High Value (HV01), High Value Transfer (HV02), High Value (HV03), Support (TP00), Structuring (TP100), identical transactions (TP101), identical transactions (TP102), Anomaly (TP103), banking threshhold (TP104), Cardinality (C-01), Large Transaction (LT-01), Velocity (V-01), Transactions (T-01) and Anamoly (A01). The list ends with + New.
Figure 8.31 The Typology type list (1), with its search box (2) and each type with its code (3)
Step 5Choose Velocity
Type Velo in the search box (1). Only Velocity (V-01) (2) remains. Click it. It appears in the field as a chip, Velocity (V-01), with × to remove it.
Figure 8.32 Typology type searched for Velo (1): Velocity, V-01 (2)
Step 6Set the suppression window
In Suppression Window type 7 in the number box (2) (default 0). Open the unit list (3) (default Hour): Hour, Day, Week, Month, Year. Choose Day (4). The Velocity (V-01) chip (1) is in Typology type above. The example uses the same length as the variables' 7-day window (see Create Typology form).
Figure 8.33 The Velocity (V-01) chip (1); Suppression Window 7 (2) and the unit list (3): Hour, Day (4), Week, Month, Year
Step 7Write the description
In Description (placeholder “Describe what this rule is monitoring and why”) state the rule in words, for example “Flags a sender with 3 or more outgoing transactions totalling ₱5,000 or more within 7 days.” The description is shown under the rule ID on the typology page. The completed card is shown in Figure 8.40.
Create Typology, details: field reference
Field
Required
What to enter / options
Typology Name
Yes (*)
3 to 100 characters (a longer name is rejected after Next Step with “Rule name must be 3-100 characters”). Letters, digits, spaces, hyphens, underscores and parentheses only. Placeholder “This is true, please proceed”. Example: Velocity 3 or more outgoing transactions totalling PHP 5000 in 7 days.
Typology type
No (optional)
A searchable list of types with codes (see step 4); the choice shows as a chip with ×. Example: Velocity (V-01).
Suppression Window
No
A number (default 0) and a unit: Hour (default), Day, Week, Month, Year. Example: 7 Day.
Description
No
Free text. Example: what the rule flags and why.
Combine groups with
—
AND (default) or OR. Applies when there is more than one group.
Group Match
—
AND (default) or OR, for the conditions inside the group. Example: AND.
WHEN field
Yes
Select field: a searchable list headed VARIABLES, newest first.
Operator
Yes
Select operator, greyed out until a field is chosen: Equal, Not Equal, Greater Than, Greater Than Equal, Less Than, Less Than Equal, Between, Not Between, In, Not In, Is Null, Is Not Null.
Compare to
Yes
Static Value (default) or Variable. A third entry, Ingested Data, is shown greyed out.
Value
Yes
With Static Value: a number in Enter value (greyed out until an operator is chosen).
Fyscal ARCX→Transaction Monitoring→Typology→+ New (conditions)
Below the details card, Combine groups with is set to AND and Group 1 has one empty row with Match set to AND. The example uses one group, so leave both settings as they are.
Step 1Open the field picker in row 1
In Group 1 click Select field (1) next to WHEN. A list opens with a Search.. box (2) and the heading VARIABLES (3); the newest variable is first. Type part of a name to narrow the list, for example sender_txn.
Figure 8.34 Group 1, row 1: Select field (1), the Search.. box (2) and the VARIABLES list (3), narrowed to sender_txn
Step 2Choose the count variable
Type sender_txn_count_7d in the search box (1). One match remains (2). Click it.
Figure 8.35 The variable list searched for sender_txn_count_7d (1): one match (2)
Step 3Choose the operator
With the variable chosen (1), open Select operator (2), now available. The list shows Equal, Not Equal, Greater Than, Greater Than Equal, Less Than and Less Than Equal; scroll for Between, Not Between, In, Not In, Is Null and Is Not Null. Choose Greater Than Equal (3). The field then reads Greater Than Equal (>=), shortened to “Greater Than Equal (>...” in the row.
Figure 8.36 Row 1: the variable (1) and the operator list (2): choose Greater Than Equal (3)
Step 4Keep Static Value
Open the compare-to list (1). It offers Static Value (2) (selected) and Variable (3); Ingested Data (4) is greyed out. Keep Static Value, because the threshold is a fixed number.
Figure 8.37 The compare-to list (1): Static Value (2), Variable (3), and Ingested Data (4) greyed out
Step 5Enter the threshold
In Enter value type 3. Row 1 is complete: the variable (1), Greater Than Equal (2), Static Value (3) and 3 (4). Next Step (5) becomes available.
Figure 8.38 Row 1 complete: sender_txn_count_7d (1), Greater Than Equal (2), Static Value (3), 3 (4); Next Step available (5)
Step 6Add the second row
Click Add Condition. A second WHEN row appears, the group heading changes to 2 conditions (1), and the label AND — all must match (2) appears between the rows. Click Select field (3) in row 2, type the name of the variable from Part 2 in the search box (4) (the screenshot searches for guide_example_sender) and click it (5).
Figure 8.39 Row 2 added: 2 conditions (1), the AND — all must match label (2), Select field (3), the search (4) and the variable from Part 2 (5)
Step 7Complete row 2
Choose Greater Than Equal from the same operator list as in step 3, keep Static Value, and type 5000 in Enter value.
Step 8Check the whole form
The first page is complete: name (1), Velocity (V-01) (2), Suppression Window 7 Day (3), description (4), Group 1 with MatchAND (5), row 1 (6) and row 2 (7). Each extra row has an × to remove it. Click Next Step (8).
Figure 8.40 Create Typology, first page complete: name (1), Velocity (2), Suppression Window (3), description (4), Group 1 (5), row 1 (6), row 2 (7) and Next Step (8)
Next Step opens Review & schedule rule (“Validate your rule, run it on historical data, then schedule and activate.”). The Schedule card has Select Schedule (1), placeholder “Select from schedule list”. Dry Run (2) is greyed out, with the note “Please add execution interval and save this rule as a draft to dry run the results.” Previous Step (3) returns to the conditions. Save as Draft (4) is greyed out until a schedule is chosen.
Figure 8.41 Review & schedule rule: Select Schedule (1), Dry Run (2), Previous Step (3) and Save as Draft (4)
Step 2Open Select Schedule
Open Select Schedule. The list has a Search Schedule box (1) and shows each existing schedule with its name and SCH- ID (2), for example Every_Quarter (SCH-07102026-000430), Every_week, Every_month and Every_day; the screenshot searches for “Every”. + New (3) is at the bottom.
Figure 8.42 The Select Schedule list: search (1), an existing schedule with its ID (2) and + New (3)
Using an existing schedule. When you choose an existing schedule (1), its fields appear in the card and can be edited. If its Start Time is in the past, the field turns red with “Start time cannot be in the past” (2) and Save as Draft (3) stays greyed out. Every_day (start 10/07/2026 12:00 AM) and Every_week (start 10/06/2026 12:10 AM) both showed this message. These fields belong to the existing schedule, and one schedule can drive many rules (see Schedule List). The example therefore creates a new schedule instead.
Figure 8.43 Every_day chosen (1): “Start time cannot be in the past” (2), and Save as Draft greyed out (3)
Step 3Start a new schedule
Open Select Schedule again and click + New. Empty schedule fields appear: Name (1), Execution Interval (2) with a Unit list (3), Start Time (4), filled with the current date and time, and End Time (5), marked optional. A Save as Draft button (6) appears in the card, greyed out.
Figure 8.44 + New: Name (1), Execution Interval (2), Unit (3), Start Time (4), End Time (5) and Save as Draft (6)
Step 4Name the schedule and set the interval
Type a Name (1) (the screenshots use guide_example_schedule). In Execution Interval (2) type 1. Open Unit (3): Hour, Day, Week, Month, Year. Until you choose a unit, a red message under the field says “Interval unit is mandatory when interval is selected”. Choose Day (4).
Figure 8.45 Name (1) and interval (2) entered; the Unit list (3): Hour, Day (4), Week, Month, Year
Step 5Open the start time picker
Click Start Time (1). A calendar opens on the current month, with arrows for the previous and next month. Dates before today (2) are greyed out and cannot be chosen. Below the calendar are a Time box (3) and Clear (4).
Figure 8.46 The Start Time field (1) and picker: past dates greyed out (2), Time (3) and Clear (4)
Step 6Choose the start date and time
Click a future date (2) (here 16 October 2026) and type the time in Time (3) (09:00 AM). The field (1) reads 10/16/2026 09:00 AM (month/day/year). The rule shown in Part 6 was saved on 7 October 2026 with a start of 08 Oct 2026, 09:00 AM.
Figure 8.47 16 October chosen (2) and 09:00 AM typed in Time (3); the field reads 10/16/2026 09:00 AM (1)
Step 7Leave End Time blank
Leave End Time (optional) (1) empty: the card states “End date is optional — leave blank to run indefinitely.” With Name, Execution Interval, Unit and a future Start Time set, Save as Draft (2) becomes available.
Figure 8.48 The new schedule complete: End Time blank (1) and Save as Draft available (2)
Schedule fields: reference
Field
Required
What to enter / options
Select Schedule
Yes (a schedule)
A searchable list of existing schedules (name and SCH- ID), and + New to create one.
Name
Yes (*)
Free text; placeholder “Enter Name”.
Execution Interval
Yes (*)
A number (placeholder 0) and a Unit: Hour, Day, Week, Month, Year. Example: 1 Day.
Start Time
Yes (*)
Date and time, MM/DD/YYYY hh:mm AM/PM. Filled with the current date and time for a new schedule. Past dates are greyed out in the picker; a past start shows “Start time cannot be in the past”. Example: 10/08/2026 09:00 AM.
End Time
No (optional)
Placeholder “Select end date & time”. Leave blank to run indefinitely.
Fyscal ARCX→Transaction Monitoring→Typology→+ New→Next Step→Save as Draft
Step 1Save the draft
Click Save as Draft in the schedule card. Wait a few seconds: the page title changes to Update Typology (1). Select Schedule (2) now shows the new schedule, and the card shows the sentence “This rule will run every 1 day starting 08 Oct 2026, 09:00:00 am” (3). Save as Draft is replaced by Update (4), greyed out. Dry Run (5) is now available, and Activate (6) appears at the bottom right. Opened again after its start time has passed, as in the screenshot, the page also shows “Start time cannot be in the past” under Start Time; the saved draft is not affected.
Figure 8.49 After Save as Draft: Update Typology (1), the schedule (2), the run summary (3), Update (4), Dry Run (5) and Activate (6)
Step 2Find the draft in the list
Open Transaction Monitoring → Typology. The new rule is the first row; later, find it by typing its name in the search box (1). The row shows the name and rule ID (2) (TMR-07102026-001091 in the example), status Draft (3), typology Velocity (4) and its creation time (5).
Figure 8.50 The new rule found by name (1): rule ID (2), status Draft (3), Velocity (4) and creation time (5)
Step 3Check the rule page
Click the row. The rule page shows the Draft chip and rule ID with the description (1), and the Draft actions Delete, Update, Duplicate Typology, Activate and Timeline & Notes (2). The summary strip (3) reads EXECUTION PERIOD 08 Oct 2026, 09:00:00 am → N/A, INTERVAL Every 1 day, COMPLEXITY Advanced, SUPPRESSION 7Day and TYPOLOGY Velocity. Group 1 (4) shows both conditions read-only, joined by AND — all must match. VARIABLES (5) has a card for each variable: the new one as Num_agg_sum and sender_txn_count_7d as Num_agg_count, both with WINDOW in last 7 day and GROUPsender_entity_id.
Figure 8.51 The draft rule page: Draft chip, ID and description (1), Draft actions (2), summary strip (3), Group 1 (4) and the two variables (5)
Step 4Check the new schedule
Open Transaction Monitoring → Schedules and switch to Schedule List. The new schedule is the first row; later, find it by typing its name in the search box (1). The row shows its name and ID (2) (SCH-07102026-000397 in the example), Last Executed — (3), Rules Linked 1 (4) and status Inactive (5).
Figure 8.52 Schedule List searched by name (1): the new schedule (2), Last Executed — (3), Rules Linked 1 (4), Inactive (5)
Fyscal ARCX→Transaction Monitoring→Typology→+ New→Next Step→Save as Draft
These steps start from the Update Typology page in Figure 8.49.
Step 1Run a dry run
In Dry run on historical records (“Test this rule against past data before going live. No alerts are created during a dry run.”), click Dry Run. It is available once the execution interval is set and the rule is saved as a draft. The result shows Time Windows, Records Scanned and Alert Created in total and per window; Re-run repeats the test and Hide Result collapses it. The dry run offers no date choice: in the Typology Library tests, with a schedule that runs every 1 day, it covered the last four one-day windows. If Records Scanned is 0, there was no data in the tested dates. A result of 0 alerts does not prove the rule works; see Judge the result: 0 is not proof. If the alert count is more than your team can review, raise the thresholds and re-run.
Step 2Request activation
Click Activate. In Activation Mode choose Shadow Mode (“Alert generated against live data will be shown in rule detail page.”) or Published Mode (“Alert from this rule will flow into Alert Manager.”). The Submit Request dialog asks for a Reason (required) and optional Supporting Documents (1 file, max 2 MB, .jpg, .jpeg, .jpe, .png, .pdf, .webp or .md) added with Attach File. Write a reason a reviewer can act on, for example “Velocity rule, 3 or more transactions totalling ₱5,000 in 7 days; dry run reviewed; start in Shadow”. Click Confirm.
Step 3Wait for approval
Activation goes through Maker Checker Approval. The request appears as an Activate Typology ticket, with status Pending, in Maker Checker Approval → Tickets, where a checker reviews it. Until it is approved, the rule stays a Draft in the typology list.
Draft
Submit Request
Pending
After a checker approves a Shadow Mode request
Pending
Approved
Shadow
After a checker approves a Published Mode request
Pending
Approved
Published
Diagram 8.2 — What an activation request changes: the ticket is Pending and the rule stays Draft
The main track of Diagram 8.2 is what the screens show after Confirm. Draft is the rule's status; Pending is the status of the Activate Typology ticket in Maker Checker Approval. While the ticket is Pending, the rule's status is still Draft. The dashed branches use the statuses the typology list offers (Shadow, Published); an approval is not shown in this guide's screenshots.
Step 4Check the live rule
Open the rule from the list. Its page shows the status (Shadow or Published), the execution period and interval from the schedule, and the conditions and variables. Use Schedule Details to see each run, and the Shadow Alerts and Live Alerts columns in Run History to see how many alerts each run raised. A paused rule shows Paused and a Resume button.
Each run calculates every variable once per Group by value (here, per sender) over its window, ending at the trigger time T. Then each group is checked.
Example: at a run on 10 Jul, sender A's outgoing remittances in the last 14 days were as below, and the run calculated the variable values in the second table.
Date
Amount
09 Jul
₱2,000
09 Jul
₱3,500
09 Jul
₱1,500
09 Jul
₱2,500
09 Jul
₱3,000
01 Jul
₱8,000
Variable
Value for sender A
outgoing remittance 1 day sum
₱12,500
outgoing remittance 1 day vol
5
outgoing remittance 14 day sum
₱20,500
outgoing remittance 14 day vol
6
Group 1: 1 day vol 5 >= 5 is true, AND 1 day sum ₱12,500 >= 10000 is true. Group 1 is true.
Group 2: 14 day vol 6 >= 5 is true, AND 14 day sum ₱20,500 >= 20000 is true. Group 2 is true.
Groups are combined with OR, so one true group is enough: the rule raises an alert for sender A.
If sender A had made no transactions at all in a variable's window, that variable would have no value for A, not 0. A condition such as Equal 0 then never matches, and Is Null is not saved in a typology condition. To test for “no transactions”, compare with the variable through a large multiplier, as the Typology Library's Rule 4 shows.
A variable only calculates a value. A condition decides whether that value is suspicious. Keeping them separate is what lets one variable serve many rules.
Fifteen typologies for patterns that standard AML rule libraries cover: structuring, velocity, high value, dormant accounts, fan-out, fan-in, large single payments, smurfing, spikes against a customer’s own history, many devices, IP addresses, instruments, currencies and destination countries, and cross-border volume. Every rule here was built in Fyscal ARCX, tested with a dry run and submitted for Shadow activation, and each step shows the screen it was done on. Follow a rule step by step, then adjust its numbers to your own risk policy.
For
Administrators
In the menu
Fyscal ARCX → Transaction Monitoring → Variables and Typology
Reading time
About 2 h
Building blocks: what the variable and typology forms can express, time windows, empty values, AND and OR, and how to read a dry run of 0 alerts.
Rule index: all fifteen rules compared on one page, with their dry-run results.
Before you build: the schedule, naming and activation rules that apply to every typology.
Every rule in this chapter is made from the same few parts. This table lists what the forms offer, as seen while building the rules. For a tour of each form, see Build a typology from scratch.
Part
Where
What you can set
Field
Create Variables → Aggregation
One of the transaction fields, for example amount, id, sender_entity_id, receiver_entity_id, sender_amount, receiver_amount, receiver_provider_country.
Function
Create Variables → Aggregation
Depends on the field. Numeric fields such as amount offer Count, Count Distinct, Sum, Average, Minimum and Maximum. Text and ID fields such as id or receiver_entity_id offer only Count, Count Distinct, Minimum and Maximum.
Group by
Create Variables → Aggregation
The field the result is calculated per, usually sender_entity_id (per sender) or receiver_entity_id (per receiver).
Time Window
Create Variables
A unit (Hours, Days, Weeks, Months, Years) and a range "Analyze Transaction from X to Y … ago". The range can end before now: 100 to 1 Days covers the 100 days up to yesterday.
Filters
Create Variables → Filters (optional)
Rows of field · operator · value, combined as "AND — all must match". Number fields: Equal, Not Equal, Greater Than, Greater Than Equal, Less Than, Less Than Equal, Between, Not Between, In, Not In. Text fields: Equal, Not Equal, In, Not In, Contains, Not Contains, Starts With, Ends With, Is Null, Is Not Null. In takes a list (type a value and press Enter for each). Static compares with a value you type; Dynamic compares with another field.
Condition
Create Typology → Group
WHEN a variable, an operator, and a comparison with a Static Value or another Variable. When you compare with a variable, a THAN MULTIPLIER box lets you compare with a fraction or multiple of it (for example 0.9 for 90%).
Groups
Create Typology
Rows in a group are combined with Match AND or OR; several groups are combined with Combine groups with AND or OR.
Typology type
Create Typology
A category from the list, for example Structuring (TP100), Velocity (V-01), High Value (HV01), Cardinality (C-01), Large Transaction (LT-01), Anomaly (TP103).
Suppression Window
Create Typology
A number and a unit (Hour, Day, Week, Month, Year).
Time windows
A variable's window is counted back from the trigger time T of each run. The first number is where the window starts and the second where it ends, both in days (or the chosen unit) before T. Diagram 9.1 places the three kinds of window used in this chapter on one line.
7 to 0 Days agothe last 7 days (Rule 1)
100 to 1 Days agoup to one day before T (Rule 4, A)
1 to 0 Days agothe last day (Rule 4, B)
100 days ago
7 days ago
1 day ago
T (run)
Diagram 9.1 — Variable windows counted back from the trigger time T (not to scale)
7 to 0 Days ago covers the last 7 days up to T. Most rules here use a window that ends at 0.
100 to 1 Days ago ends one day before T, so it leaves out the most recent day. The form's timeline then reads 1 day ago. On a typology page the variable card shows only the start (“in last 100 day”); check the end on View Variable.
1 to 0 Days ago covers only the most recent day. Rule 4 pairs it with the 100-to-1 window: the two windows meet at “1 day ago” and do not overlap, so “no activity before, then a payment now” can be tested.
An empty value is not 0
When a customer has no transactions in a variable’s window, the variable has no value for that customer: it is empty, not 0. A comparison with a fixed number, such as Equal 0 or Less Than Equal 0, therefore does not match that customer.
The operator list also offers Is Null and Is Not Null, but do not use them in a typology condition: the condition is not saved with the rule, and the rule runs without it. No message is shown, and the rule page then lists only the other conditions.
When one variable is compared with another, an empty value counts as 0. Rule 4 uses this to test for “no transactions”: it compares the amount sent in the last day with the earlier transaction count multiplied by 1,000,000,000,000. One earlier transaction makes that product far larger than any amount, so the condition fails. No earlier transaction makes it 0, so the condition passes.
Condition on a Count variable
Sender with 4 transactions in the window
Sender with no transactions in the window
Value of the variable
4
Empty (no value)
Equal 0 matches
No
NoRule 4 first version: 0 alerts
Greater Than Equal 0 matches
Yes
NoTest with no matching transactions: 0 alerts
Is Null in a typology condition
Not saved
Not savedRule 4 second version ran as “≥ ₱5,000” only
Last-day sum Greater Than Equal the count × 1,000,000,000,000 (Rule 4)
No
YesRule 4: 279 alerts
How AND and OR combine conditions
Inside a group, Match decides how the rows combine; the form and the rule page print the choice between the rows as AND — all must match or OR — any one matches. For two conditions A and B on the same sender:
Condition A
Condition B
Match AND: alert
Match OR: alert
True
True
Yes
Yes
True
False
No
Yes
False
True
No
Yes
False
False
No
No
Groups combine the same way, following Combine groups with. The rule in Typology detail (Figure 8.6) has AND — all must match inside each group and OR — any one matches between its three groups: it alerts when any one group is fully true. Every rule in this chapter uses a single group; Rules 4 and 9 have two conditions joined by AND.
Reading a dry run of 0 alerts
A dry run that creates 0 alerts can mean that the test period has no such pattern, or that the rule cannot read the data. A positive control tells them apart: lower the threshold for one run so that any matching record would alert, then restore it. The method is shown step by step in Test a typology with Dry Run.
0 alerts. With the threshold lowered for one run (for example Greater Than Equal 1), does the dry run create alerts?
Yes
The rule reads the data; the test period has no such pattern. Restore the threshold, re-run and keep the rule.
No
Does a condition test for “no activity” with Equal 0?
Yes
Compare the amount with that variable through a large multiplier instead (Rule 4), then re-run. Is Null is not saved in a condition.
No
Check the variable on View Variable: field, filter values, window. Fix it and re-run.
Diagram 9.2 — Does a rule with 0 alerts work? The positive-control check
Nine of the fifteen rules in this chapter created 0 alerts at their real threshold, and every one of them created alerts in its positive control (see the Rule index). A control only shows that the variable reads data: for Rule 13 it shows that currency_code is filled in, not that any sender uses several currencies.
All fifteen rules at a glance. Entity is the field the variables are grouped by: sender_entity_id (per sender) for every rule except Rule 6, which uses receiver_entity_id (per receiver). Dry run gives the alerts created at the rule’s real threshold; where that was 0, Control gives the result with the threshold lowered for one run (see Test a typology with Dry Run).
Create variables first. A typology's conditions can only pick variables that already exist.
Names. Typology names can contain only letters, digits, spaces, hyphens, underscores and parentheses, so write amounts as "PHP 5000" rather than "₱5,000". A name must be 3 to 100 characters (see Rule 9).
A schedule with a future start. Save as Draft stays disabled until you choose a schedule whose start time is in the future. Rule 1 creates a daily schedule; the other rules reuse it. Its start was later moved from 01 Jan 2027 to 09 Oct 2026, 09:00 AM (Rule 1, step 31); screenshots taken before the change still show 01/01/2027. Choosing an existing schedule shows its fields in the form; those fields belong to that schedule, which other rules may also use.
Saving. After Save as Draft, wait a few seconds: the page becomes Update Typology and the rule is listed as Draft.
Red flagSeveral payments just under an amount you review
Logic
Counts the sender's transactions of ₱450,000 up to ₱499,999 in the last 7 days.
Window
7 to 0 Days
Threshold
≥ 3 between ₱450,000 and ₱499,999
✓ Verified by positive control
What it detects and why. This rule flags a sender who makes three or more transactions within 7 days, each from ₱450,000 up to just under ₱500,000. Several payments that each stay just below an amount you want reviewed can be one larger sum split up to avoid that review, so the pattern is worth a look even when no single payment stands out.
This is the most detailed of the rules: it shows every screen once, including the schedule that the other rules reuse. In the screenshots every example object carries the GUIDE EXAMPLE or guide_example_ prefix; the text gives the names without it (see Before you build). For a tour of each form, see Build a typology from scratch.
Item
Setting
Variable struct_count_7d
Count of id (the number of transactions), grouped by sender_entity_id, Days from 7 to 0, filters amountGreater Than Equal 450000 AND amountLess Than 500000
Typology type
Structuring (TP100)
Suppression Window
7 Day
Condition
Group 1, Match AND: struct_count_7dGreater Than Equal (>=) Static Value 3
Schedule
New schedule schedule_2027: every 1 Day, no end time; created with the start 01 Jan 2027, 09:00 AM and later moved to 09 Oct 2026, 09:00 AM (step 31)
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Go to Transaction Monitoring → Variables and click + New. In Create Variables, leave Transaction selected. In Variable name (1) type struct_count_7d. In Description (2) write what the number means, for example “Number of transactions per sender between PHP 450000 and 500000 in the last 7 days.” The name says what is counted and over which window, so it is easy to pick later in a condition.
Figure 9.1 Create Variables: Variable name and Description filled in
Step 2Choose the Field: id
Open Field. The list has a Search Fields box and the 51 transaction fields. Choose id. Every transaction has one id, so counting id values counts transactions.
Figure 9.2 The Field list, before id is chosen
Step 3Choose the Function: Count
Open Function. Because id is an ID field, the list offers only Count, Count Distinct, Minimum and Maximum; Sum and Average appear only for numeric fields such as amount. Choose Count: the rule needs the number of qualifying transactions.
Figure 9.3 Function for the id field: Count, Count Distinct, Minimum, Maximum
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id. The count is then calculated separately for each sender, which is what makes it a per-customer measure.
Figure 9.4 The Group by list
Step 5Set the time window: Days, 7 to 0
Scroll down. Group by now reads sender_entity_id (1). Under Time Window, click Days (2); the default is Hours. In Analyze Transaction from enter 7 and in to enter 0 (3). The line reads “from 7 to 0 Days ago”: the 7 days up to the trigger time, shown as “Triggered at T (00:00)”.
Figure 9.5 Group by set, and the time window set to 7 to 0 Days ago
Step 6Add filter 1: choose the amount field
Under Filters (1)(optional), open Field in the blank row and type amount. Four fields match: amount, orig_currency_amount, receiver_amount and sender_amount. Choose amount. The filters decide which transactions are counted; without them every transaction would count.
Figure 9.6 Filter row 1: the field search for amount
Step 7Filter 1: choose Greater Than Equal and type 450000
Open Operator.... For a number field the list is Equal, Not Equal, Greater Than, Greater Than Equal, Less Than, Less Than Equal, Between, Not Between, In and Not In (scroll for the last four). Choose Greater Than Equal, then type 450000 in Enter value. This sets the lower edge of the band: ₱450,000 itself is counted.
Figure 9.7 Filter operators for a number field
Step 8Why not Between
Choosing Between (1) replaces the value box with From and To (2). The screen does not say whether Between includes its end values, so this rule uses two rows with explicit operators instead. Under every row is a Static / Dynamic toggle (3): Static compares with a value you type.
Figure 9.8 Between shows From and To boxes; the Static and Dynamic toggle
Step 9Add filter 2: amount Less Than 500000
With row 1 reading amountGreater Than Equal 450000 (1), click Add Filter. A second row appears, joined to the first by AND — all must match (2): a transaction is counted only if it passes both rows. Choose amount, open the operator list, type Less Than and choose Less Than (3). Type 500000. ₱500,000 itself is not counted, so the band is ₱450,000 up to, but not including, ₱500,000.
Figure 9.9 Filter row 2 added, joined by AND — all must match
Step 10Keep Static
Clicking Dynamic (1) changes the value box to Field..., a list of other numeric fields to compare with: mode_of_transaction, orig_currency_amount, receiver_amount and sender_amount (2). This rule compares with fixed amounts, so switch the row back to Static and keep 500000.
Figure 9.10 Dynamic compares with another numeric field
Step 11Check the form and save
Check the whole form: id / Count / sender_entity_id (1), Days 7 to 0 (2), and Filters (2) with both rows set to Static (3). Click Save Variable (4).
Figure 9.11 The completed variable form before saving
Step 12Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, with its ID (VAR-08102026-000769 in the example) and the Created time.
Figure 9.12 The new variable at the top of the Variables list
Step 13Check the saved variable
Click the row. View Variable opens with the type tag STR_AGG_COUNT (1), the CREATED and UPDATED times and user (2), and Edit, Delete and Duplicate (3). The fields are read-only.
Figure 9.13 View Variable: type tag, created and updated, Edit, Delete and Duplicate
Step 14Check that both filters were saved
Scroll down. Filters (2) (1) shows both rows joined by AND — all must match. Update Variable (2) is greyed out until you click Edit. Close the dialog with ×.
Figure 9.14 View Variable: both filters saved
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 15Name the rule and set the suppression window
Go to Transaction Monitoring → Typology and click + New. In Typology Name (1) type R01 Structuring - 3 or more transactions between PHP 450000 and 500000 in 7 days; names allow only letters, digits, spaces, hyphens, underscores and parentheses, so the amount is written as PHP. In Suppression Window type 7 (2), open the unit list (Hour, Day, Week, Month, Year) and choose Day (3). The example matches the 7-day variable window (see Building blocks).
Figure 9.15 Typology Name, Suppression Window 7 and the unit list
Step 16Choose the typology type
Open Typology type(optional) and type Struct. One type matches: Structuring TP100. Click it. Do not click + New, which creates a new type.
Figure 9.16 Typology type search: Structuring TP100
Step 17Write the description and check the card
In Description state the rule in words, for example “Flags a sender with 3 or more transactions of PHP 450000 to under 500000 in 7 days.” The card now shows the name (1), the chip Structuring (TP100) (2), 7 Day (3) and the description (4).
Figure 9.17 The completed details card
Step 18Choose the variable in row 1
Below the card, leave Combine groups with and Match on AND. In Group 1, click Select field next to WHEN, type struct and click struct_count_7d under VARIABLES.
Figure 9.18 Row 1: the variable search
Step 19Choose the operator: Greater Than Equal
Open Select operator. The list is Equal, Not Equal, Greater Than, Greater Than Equal, Less Than, Less Than Equal, then (scroll) Between, Not Between, In, Not In, Is Null and Is Not Null. Choose Greater Than Equal; the field shows Greater Than Equal (>=).
Figure 9.19 Row 1: the operator list
Step 20Keep Static Value
The compare-to list offers Static Value (selected) and Variable; Ingested Data is greyed out. Keep Static Value: the threshold is a fixed number.
Figure 9.20 Row 1: compare with Static Value
Step 21Enter 3 and go to the next step
Type 3 in Enter value. Check the page: name (1), type (2), 7 Day (3), description (4), Match AND (5) and the row struct_count_7dGreater Than Equal (>=)Static Value 3 (6). Next Step (7) is now available. Click it.
Figure 9.21 The completed Create Typology page
Part C: Create the schedule and save
Step 22Read the Review & schedule rule page
Review & schedule rule opens. Select Schedule (1) is empty. Dry Run (2) and Save as Draft (3) are greyed out. Previous Step (4) returns to the conditions.
Figure 9.22 Review & schedule rule before a schedule is chosen
Step 23Start a new schedule
Open Select Schedule. The search finds only an older schedule from another walkthrough. This rule creates its own, so click + New. A schedule can serve many rules, which is why the other rules reuse this one.
Figure 9.23 Select Schedule with + New
Step 24Read the empty schedule fields
The card shows Name (1), Execution Interval (2) with a Unit list (3), Start Time (4), filled with the current date and time, and End Time(optional) (5). A Save as Draft button (6) appears inside the card, greyed out.
Figure 9.24 Empty fields for a new schedule
Step 25Name the schedule and set every 1 Day
Type schedule_2027 in Name and 1 in Execution Interval (1). Until you choose a unit, the message “Interval unit is mandatory” shows under the field. Open Unit and choose Day (2). The rule then runs once a day.
Figure 9.25 Execution Interval 1 and the Unit list
Step 26Open the start time picker
Click Start Time. The calendar opens on the current month; dates before today are greyed out. Below it are Time and Clear.
Figure 9.26 The Start Time calendar
Step 27Set 01 Jan 2027, 09:00 AM
Click the next-month arrow until January 2027, click 1 (2) and type 09:00 AM in Time (3). The field reads 01/01/2027 09:00 AM (1). The start time must be in the future for Save as Draft to become available (see Before you build).
Figure 9.27 Start Time set to 01/01/2027 09:00 AM
Step 28Leave End Time blank and save the draft
Leave End Time empty (1): “End date is optional — leave blank to run indefinitely.” Click Save as Draft in the card (2).
Figure 9.28 The completed schedule and Save as Draft
Step 29Check the saved draft
Wait a few seconds: the title changes to Update Typology (1). Select Schedule shows schedule_2027 (2) and the card reads “This rule will run every 1 day starting 01 Jan 2027, 09:00:00 am” (3). Save as Draft is replaced by Update (4); Dry Run (5) and Activate (6) are now available. To test and activate, see Test a typology with Dry Run and Request Shadow activation.
Figure 9.29 After Save as Draft: the Update Typology page
Step 30Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID, here TMR-08102026-001123 (1); the summary EXECUTION PERIOD 01 Jan 2027, 09:00:00 am → N/A, INTERVAL Every 1 day, SUPPRESSION 7Day and TYPOLOGY Structuring (2); the condition (3); and the variable card, Str_agg_count, WINDOW in last 7 day, GROUPsender_entity_id (4).
Figure 9.30 The saved Rule 1 as a Draft
Step 31Move the schedule’s start (later change)
The example schedule was later moved to start on 09 Oct 2026, so the rules could be activated sooner. On any rule that uses it, open Review & schedule rule, click Start Time, pick the date and keep 09:00 AM: the field reads 10/09/2026 09:00 AM (1) and the card “This rule will run every 1 day starting 09 Oct 2026, 09:00:00 am” (2). Click Update (3) and confirm the dialog (see Test a typology with Dry Run, step 5). The change is on the shared schedule: Rule 1’s page showed the new start after a reload.
Figure 9.31 Start Time moved to 10/09/2026 09:00 AM; Update
How it evaluates. At each daily run the variable counts, for each sender, the transactions in the last 7 days whose amount is at least ₱450,000 and below ₱500,000. Sender A sent ₱480,000, ₱495,000 and ₱460,000 during those 7 days: the count is 3, 3 >= 3 is true, and the rule raises an alert. Sender B sent ₱480,000, ₱490,000 and ₱500,000: the ₱500,000 payment fails Less Than 500000, so the count is 2 and there is no alert. Sender C sent ₱300,000 four times: none is in the band, the count is 0, no alert.
Tuning. The numbers you can change are: the band (the two filter values, 450000 and 500000), set from the amount you want reviewed; the count threshold (3) in the condition; the window (Analyze Transaction from 7); and the Suppression Window (7 Day). A wider band, a lower count or a longer window raises more alerts. The example sets the Suppression Window to the same length as the variable window (see Building blocks). Run a Dry Run after each change to see the alert volume.
Dry-run result. In testing, the rule created 0 alerts at 3 or more transactions: few transactions fall in the ₱450,000 to ₱499,999 band. With the threshold temporarily at 1 it created 4 alerts, so the variable and its two filters work. The full dry run, control and restore for this rule are shown in Test a typology with Dry Run.
What it detects and why. This rule flags a sender who makes 10 or more transactions in one day. A sudden burst of activity can mean an account is being used to move money quickly, so a count well above what your customers normally do is worth reviewing.
The screens are the same as in Rule 1; this section shows each step with this rule's values.
Item
Setting
Variable txn_count_1d
Count of id (the number of transactions), grouped by sender_entity_id, Days from 1 to 0, no filters
Typology type
Velocity (V-01)
Suppression Window
1 Day
Condition
Group 1, Match AND: txn_count_1dGreater Than Equal (>=) Static Value 10
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables. Leave Transaction selected, type txn_count_1d in Variable name (1) and a description such as “Number of transactions per sender in the last 1 day.” (2).
Figure 9.32 Rule 2 variable: name and description
Step 2Choose the Field: id
Open Field, type id in Search Fields and choose id, the first match. Counting id counts transactions.
Figure 9.33 Field search for id
Step 3Choose the Function: Count
Open Function (Count, Count Distinct, Minimum, Maximum) and choose Count.
Figure 9.34 Function: Count
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity and choose sender_entity_id, so each sender gets their own count.
Figure 9.35 Group by search: sender_entity_id
Step 5Set the time window: Days, 1 to 0
Click Days (1) and set Analyze Transaction from 1 to 0 (2): the last day up to the trigger time T.
Figure 9.36 Time window 1 to 0 Days ago
Step 6Leave the filter row empty and save
Leave the blank row under Filters (1) (1) empty: every transaction counts. A blank row is dropped when you save. Click Save Variable (2).
Figure 9.37 Blank filter row and Save Variable
Step 7Find the variable in the list
The new variable is the first row, here VAR-08102026-000770.
Figure 9.38 Rule 2 variable in the Variables list
Step 8Check the saved variable
Click the row. View Variable shows STR_AGG_COUNT (1), the created and updated details (2), the window 1 to 0 Days ago (3) and Filters (0) (4), confirming that the blank row was not saved.
Figure 9.39 View Variable for the Rule 2 variable
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 9Fill in the details and choose Velocity
Click + New on Typology. Type the name R02 Velocity - 10 or more transactions in 1 day (1). Set Suppression Window to 1 and choose Day from the unit list (2), matching the 1-day window. Write a description (3). Open Typology type (4), type Velo and click Velocity V-01.
Figure 9.40 Rule 2 details and the Typology type search for Velocity
Step 10Choose the variable in row 1
In Group 1, click Select field, type txn and click txn_count_1d.
Figure 9.41 Rule 2 row 1: variable search
Step 11Choose Greater Than Equal
Open Select operator and choose Greater Than Equal.
Figure 9.42 Rule 2 row 1: operator list
Step 12Keep Static Value
Keep Static Value in the compare-to list.
Figure 9.43 Rule 2 row 1: Static Value
Step 13Enter 10 and go to the next step
Type 10 in Enter value. The page shows the name (1), Velocity (V-01) (2), 1 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.44 The completed Rule 2 page
Part C: Choose the schedule and save
Step 14Select the existing schedule
On Review & schedule rule, open Select Schedule, type schedule_2027 and click schedule_2027 (SCH-08102026-000463), created in Rule 1. Do not click + New.
Figure 9.45 Select Schedule: the schedule from Rule 1
Step 15Check the schedule and save the draft
The schedule's fields fill in (2): 1 Day, start 01/01/2027 09:00 AM, no end time. They belong to the shared schedule, so leave them unchanged; editing them would affect every rule that uses it. The screenshots show the start in force when they were taken. Click Save as Draft (3).
Figure 9.46 The selected schedule and Save as Draft
Step 16Check the saved draft
Wait a few seconds: the page becomes Update Typology (1), with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6).
Figure 9.47 Rule 2 after Save as Draft
Step 17Check the rule page
The rule page shows Draft TMR-08102026-001124 (1), SUPPRESSION 1Day and TYPOLOGY Velocity (2), the condition txn_count_1dGreater Than Equal (>=) 10 (3) and the variable card with WINDOW in last 1 day (4).
Figure 9.48 The saved Rule 2 as a Draft
How it evaluates. At each daily run the variable counts each sender's transactions in the last day, whatever their amount. Sender A made 12 transfers of about ₱1,000 each: 12 >= 10, so the rule raises an alert. Sender B made 9 transfers totalling ₱900,000: 9 is below 10, so there is no alert from this rule (Rule 3 looks at value instead).
Dry-run result. In testing, the rule created 0 alerts at 10 or more transactions in a day. With the threshold temporarily at 1 it created 764 alerts (0 / 0 / 500 / 264 by window, newest first): the 1-day window only finds transactions in the days that contain records. The threshold was then restored to 10.
Tuning. You can change the count threshold (10), the window (Analyze Transaction from 1, or a different unit such as Hours for a shorter burst) and the Suppression Window (1 Day). To count only one kind of transaction, add a filter row to the variable, as in Rule 1. Set the threshold from what your customers normally do, and check the volume with a Dry Run.
Adds up the amount the sender sent in the last 30 days.
Window
30 to 0 Days
Threshold
≥ ₱5,000,000
✓ Verified by positive control
What it detects and why. This rule flags a sender whose payments add up to ₱5,000,000 or more within 30 days. Looking at the 30-day total, rather than single payments, catches a large amount moved in several pieces as well as in one.
The screens are the same as in Rule 1. The difference is the variable: it sums amount instead of counting transactions.
Item
Setting
Variable sent_sum_30d
Sum of amount, grouped by sender_entity_id, Days from 30 to 0, no filters
Typology type
High Value (HV01)
Suppression Window
30 Day
Condition
Group 1, Match AND: sent_sum_30dGreater Than Equal (>=) Static Value 5000000
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables. Type sent_sum_30d in Variable name (1) and a description such as “Total amount sent per sender in the last 30 days.” (2).
Figure 9.50 Rule 3 variable: name and description
Step 2Choose the Field: amount
Open Field and choose amount, the transaction amount.
Figure 9.51 Field: amount
Step 3Choose the Function: Sum
Open Function. Because amount is numeric, all six functions are offered: Count, Count Distinct, Sum, Average, Minimum and Maximum. Choose Sum to add the amounts together.
Figure 9.52 Function for amount: all six functions
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity and choose sender_entity_id, so each sender gets their own total.
Figure 9.53 Group by: sender_entity_id
Step 5Set the time window: Days, 30 to 0
Click Days (1) and set Analyze Transaction from 30 to 0 (2).
Figure 9.54 Time window 30 to 0 Days ago
Step 6Leave the filter row empty and save
Leave the blank filter row (1) empty, so every payment counts towards the total, and click Save Variable (2).
Figure 9.55 Blank filter row and Save Variable
Step 7Find the variable in the list
The new variable is the first row, here VAR-08102026-000771.
Figure 9.56 Rule 3 variable in the Variables list
Step 8Check the saved variable
View Variable shows the type tag NUM_AGG_SUM (1), the created and updated details (2), 30 to 0 Days ago (3) and Filters (0) (4).
Figure 9.57 View Variable for the Rule 3 variable
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 9Fill in the details and choose High Value
Click + New on Typology. Type the name R03 High value - PHP 5000000 or more sent in 30 days (1), set Suppression Window 30 Day (2), matching the 30-day window, and write a description (3). Open Typology type (4) and type High: three types match, High Value HV01, High Value Transfer HV02 and High Value HV03. Click High Value HV01.
Figure 9.58 Rule 3 details and the Typology type search for High
Step 10Choose the variable in row 1
Click Select field and type sent_sum. The list can show similar variables from other rules; click sent_sum_30d.
Figure 9.59 Rule 3 row 1: choose sent_sum_30d
Step 11Choose Greater Than Equal
Open Select operator and choose Greater Than Equal.
Figure 9.60 Rule 3 row 1: operator list
Step 12Keep Static Value
Keep Static Value.
Figure 9.61 Rule 3 row 1: Static Value
Step 13Enter 5000000 and go to the next step
Type 5000000 (no separators) in Enter value. Check the name (1), High Value (HV01) (2), 30 Day (3), description (4), Match AND (5) and the row (6), then click Next Step (7).
Figure 9.62 The completed Rule 3 page
Part C: Choose the schedule and save
Step 14Select the existing schedule
Open Select Schedule, search for schedule_2027 and click it.
Figure 9.63 Select Schedule: the schedule from Rule 1
Step 15Save the draft
Leave the shared schedule's fields (2) unchanged and click Save as Draft (3).
Figure 9.64 The selected schedule and Save as Draft
Step 16Check the saved draft
The page becomes Update Typology (1) with the run sentence (3), Dry Run (5) and Activate (6).
Figure 9.65 Rule 3 after Save as Draft
Step 17Check the rule page
The rule page shows Draft TMR-08102026-001125 (1), SUPPRESSION 30Day and TYPOLOGY High Value (2), the condition with 5000000 (3) and the variable card, Num_agg_sum, in last 30 day (4).
Figure 9.66 The saved Rule 3 as a Draft
How it evaluates. At each daily run the variable adds up each sender's payments over the last 30 days. Sender A sent ₱2,000,000, ₱1,800,000 and ₱1,500,000: the total is ₱5,300,000, which is >= 5000000, so the rule raises an alert. Sender B sent one payment of ₱4,900,000: the total is below ₱5,000,000 and there is no alert.
Dry-run result. In testing, no sender reached ₱5,000,000 in 30 days, so the rule created 0 alerts. With the threshold temporarily at 1 it created 6,512 alerts, then the threshold was restored.
Tuning. You can change the amount (5000000), the window (30 Days), and the Suppression Window (30 Day). Variant, not tested with Dry Run: for incoming value, build a second variable that sums amount grouped by receiver_entity_id. To total only one kind of transaction, add a filter row. Choose the amount from your own risk assessment and check the alert volume with a Dry Run.
Checks that the sender had no transactions from 100 to 1 days ago, then adds up what they sent in the last day.
Window
100 to 1 Days and 1 to 0 Days
Threshold
Sum ≥ ₱5,000 AND sum ≥ 1,000,000,000,000 × count
✓ Verified · 279 alerts
What it detects and why. This rule flags a sender who made no transactions from 100 days ago up to yesterday, and then sends ₱5,000 or more in the last day. An account that wakes up after a long quiet period and moves money straight away is a change in behaviour worth reviewing.
It needs two variables, one for the quiet period and one for the new activity, and two conditions that must both be true. The screens are the same as in Rule 1.
Item
Setting
Variable A count_100d_to_1d
Count of id, grouped by sender_entity_id, Days from 100 to 1: the transactions from 100 days ago up to 1 day ago, leaving out the last day
Variable B sent_sum_1d
Sum of amount, grouped by sender_entity_id, Days from 1 to 0: the amount sent in the last day
Typology type
Anomaly (TP103)
Suppression Window
1 Day
Conditions
Group 1, Match AND: sent_sum_1dGreater Than Equal (>=) 5000 AND sent_sum_1dGreater Than Equal (>=) variable count_100d_to_1d, multiplier 1000000000000
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, start moved to 16 Oct 2026, 10:00 AM, no end time
Part A: Create variable A, the quiet period
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name variable A
Click + New on Variables. Type count_100d_to_1d (1) and a description such as “Number of transactions per sender from 100 days ago up to 1 day ago (excludes the last day).” (2).
Figure 9.68 Variable A: name and description
Step 2Choose the Field: id
Open Field, search id and choose id.
Figure 9.69 Variable A: Field id
Step 3Choose the Function: Count
Choose Count: the rule needs to know whether there were any transactions at all.
Figure 9.70 Variable A: Function Count
Step 4Choose Group by: sender_entity_id
Search sender_entity and choose sender_entity_id.
Figure 9.71 Variable A: Group by sender_entity_id
Step 5Set the window: Days, 100 to 1
Click Days (1), then enter 100 in Analyze Transaction from and 1 in to (2). The form accepts a window that ends before the trigger time, and the caption reads “1 day ago · Triggered at T (00:00)” (3). Ending at 1 leaves out the last day, so the payment that wakes the account up does not count against the quiet period.
Figure 9.72 Variable A: window 100 to 1 Days ago
Step 6Leave the filter row empty and save
Leave the blank filter row (1) empty and click Save Variable (2).
Figure 9.73 Variable A: blank filter row and Save Variable
Step 7Find variable A in the list
Variable A is the first row, here VAR-08102026-000772.
Figure 9.74 Variable A in the Variables list
Step 8Check variable A
View Variable shows STR_AGG_COUNT (1), the created and updated details (2), 100 to 1 Days ago (3), Filters (0) (4) and the caption “1 day ago” (5): the end of the window was saved.
Figure 9.75 View Variable for variable A, window 100 to 1
Part B: Create variable B, the new activity
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 9Open the form and name variable B
Click + New again. Type sent_sum_1d (1) and a description such as “Total amount sent per sender in the last 1 day.” (2).
Figure 9.76 Variable B: name and description
Step 10Choose the Field: amount
Open Field and choose amount.
Figure 9.77 Variable B: Field amount
Step 11Choose the Function: Sum
Choose Sum from the six functions offered for a numeric field.
Figure 9.78 Variable B: Function Sum
Step 12Choose Group by: sender_entity_id
Search sender_entity and choose sender_entity_id. Both variables must use the same Group by, so that the two conditions talk about the same sender.
Figure 9.79 Variable B: Group by sender_entity_id
Step 13Set the window: Days, 1 to 0
Click Days (1) and set 1 to 0 (2): the last day, the part that variable A leaves out.
Figure 9.80 Variable B: window 1 to 0 Days ago
Step 14Leave the filter row empty and save
Leave the blank filter row (1) empty and click Save Variable (2).
Figure 9.81 Variable B: blank filter row and Save Variable
Step 15Find variable B in the list
Variable B is the first row, here VAR-08102026-000773.
Figure 9.82 Variable B in the Variables list
Step 16Check variable B
View Variable shows NUM_AGG_SUM (1), the created and updated details (2), 1 to 0 Days ago (3) and Filters (0) (4).
Figure 9.83 View Variable for variable B
Part C: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 17Fill in the details and choose Anomaly
Click + New on Typology. Type the name R04 Dormant account - no activity for 100 days then PHP 5000 or more in 1 day (1), set Suppression Window 1 Day (2), matching the 1-day activity window, and write a description (3). Open Typology type (4), type Anomaly and click Anomaly TP103.
Figure 9.84 Rule 4 details and the Typology type search for Anomaly
Step 18Row 1: variable B Greater Than Equal 5000
In Group 1, click Select field (1), type sent_sum in the search box (2) and click sent_sum_1d (3). Choose Greater Than Equal, keep Static Value and type 5000.
Figure 9.85 Row 1: Select field (1), the search sent_sum (2) and the variable sent_sum_1d (3)
Step 19Row 2: compare variable B with a variable
Row 1 (1) now reads sent_sum_1dGreater Than Equal 5000. Click Add Condition. In row 2 choose sent_sum_1d again and Greater Than Equal (2). Open the value type, which reads Static Value (3), and choose Variable (4).
Figure 9.86 Row 1 complete (1); row 2 field and operator (2); the value type list (3) with Variable (4)
Step 20Row 2: choose variable A and the multiplier
Click Select variable, type count_100d and click count_100d_to_1d. A THAN MULTIPLIER box appears under it: type 1000000000000 (one trillion). Row 2 now asks whether the amount sent in the last day is at least variable A × 1,000,000,000,000.
Step 21Check both rows and go to the next step
Row 1 (1) reads sent_sum_1dGreater Than Equal 5000. AND — all must match (2) joins it to row 2: sent_sum_1dGreater Than Equal (3), compared with the Variablecount_100d_to_1d (4) and the multiplier 1000000000000 (5). Keep Match on AND: with OR, every sender of ₱5,000 would alert on row 1 alone. Click Next Step at the bottom right.
Figure 9.87 Rule 4 conditions: row 1 (1), AND (2), row 2 field and operator (3), variable A (4) and the multiplier (5)
Part D: Choose the schedule and save
Step 22Select the existing schedule
Open Select Schedule, search for schedule_2027 and click it.
Figure 9.88 Select Schedule: the schedule from Rule 1
Step 23Check the start time and save the draft
Select Schedule shows schedule_2027 (1). The shared schedule's Start Time (2) must be in the future: if it is in the past, the form shows “Start time cannot be in the past” and Save as Draft stays greyed out. Pick a later date and time; here the start was moved to 16 Oct 2026, 10:00 AM. Two schedules with exactly the same interval and start cannot both exist: if another schedule already uses that start, the save does nothing, so choose a different time. Click Save as Draft (3).
Figure 9.89 The selected schedule (1), its start time (2) and Save as Draft (3)
Step 24Check the saved draft
The page becomes Update Typology (1), with the run sentence “This rule will run every 1 day starting 16 Oct 2026, 10:00:00 am” (2), Dry Run (3) and Activate (4).
Figure 9.90 Rule 4 after Save as Draft: Update Typology (1), the run sentence (2), Dry Run (3) and Activate (4)
Step 25Check the saved conditions on the rule page
Open the rule from Transaction Monitoring → Typology: Draft, TMR-15102026-001217 (1). Group 1 shows both saved conditions: row 1 (2), sent_sum_1dGreater Than Equal (>=) 5000, and row 2 (3), sent_sum_1dGreater Than Equal (>=)count_100d_to_1d (multiplied by 1000000000000). Under VARIABLES 2 (4) both variables are listed. Always check this page after saving: a condition that was not saved does not appear here.
Figure 9.91 Rule 4 rule page: the draft ID (1), the two saved conditions (2) and (3), and the two variables (4)
How it evaluates. At each daily run both variables are calculated for each sender, and both conditions must be true. Sender A last transacted 120 days ago and sent ₱20,000 in the last day: variable A (100 to 1 days ago) is empty and counts as 0 in row 2, so ₱20,000 >= 5000 and ₱20,000 >= 0 × 1,000,000,000,000 are both true: the rule raises an alert. Sender B also sent ₱20,000 in the last day but made one ₱500 payment 40 days ago: variable A is 1, and ₱20,000 is far below 1 × 1,000,000,000,000, so row 2 is false and there is no alert. Sender C was quiet for 100 days and sent ₱3,000 in the last day: row 1 is false, no alert. Because variable A stops 1 day ago, sender A's ₱20,000 payment does not count in variable A.
Dry-run result. In testing the rule created 279 alerts: 0 / 50 / 126 / 103 by window, newest first (1 to 4). On the same four days, the earlier version, saved without its “no transactions” condition, created 1,727: row 2 removes the senders who had transactions in the previous 100 days.
Figure 9.92 Rule 4 dry run: 279 alerts (1), and the windows with 50 (2), 126 (3) and 103 (4) alerts
Tuning. You can change the length of the quiet period (100 in variable A, keeping the end at 1 so it never overlaps variable B's window), the amount that counts as reactivation (5000), the activity window (variable B's 1 to 0, with variable A's end value moved to match) and the Suppression Window (1 Day). Keep the multiplier at 1000000000000: it only has to be larger than any amount a sender could send in a day. A shorter quiet period or a lower amount raises more alerts. Confirm the result with a Dry Run.
Counts the different receivers the sender paid in the last 7 days.
Window
7 to 0 Days
Threshold
≥ 10 receivers
✓ Verified · 240 alerts
What it detects and why. One sender pays 10 or more different receivers within 7 days, for example ₱3,000 to each of twelve new accounts. Spreading funds across many receivers is a common way to move money onward quickly or to hide who finally receives it.
Item
Setting
Variable distinct_receivers_7d
The number of different receivers (Count Distinct of receiver_entity_id) each sender paid in the last 7 days (Group bysender_entity_id, from 7 to 0 Days ago). No filters.
Typology type
Cardinality (C-01)
Suppression Window
7 Day
Condition
distinct_receivers_7dGreater Than Equal (>=) 10
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open Create Variables and name the variable
Go to Transaction Monitoring → Variables and click + New (the empty form is shown in Part 2 of the walkthrough). Leave Transaction selected (1): the variable is calculated from transactions. In Variable name (2) type distinct_receivers_7d. In Description (3) type a note such as “Number of distinct receivers per sender in the last 7 days.” The description appears on the variable card of every typology that uses the variable.
Figure 9.93 Transaction selected, Variable name distinct_receivers_7d and Description filled in
Step 2Choose the Field
Open Field and type receiver_entity in Search Fields. Choose receiver_entity_id. This is the value the variable counts: the ID of the customer who received each transaction.
Figure 9.94 The Field list searched for receiver_entity: choose receiver_entity_id
Step 3Choose the Function
Open Function. For receiver_entity_id the list offers Count, Count Distinct, Minimum and Maximum only (text and ID fields have no Sum or Average). Choose Count Distinct. Count Distinct counts each receiver once, so ten payments to the same receiver count as 1. Count would count transactions instead.
Figure 9.95 The Function list for receiver_entity_id: choose Count Distinct
Step 4Choose Group by
Open Group by and type sender_entity in the search box. Choose sender_entity_id. The count is calculated separately for each sender, so the rule can flag the sender who fans out.
Figure 9.96 Group by searched for sender_entity: choose sender_entity_id
Step 5Set the time window and check the form
Scroll down to Time Window. Click Days (1); the default is Hours. In Analyze Transaction from enter 7 and in to enter 0 (2). The line reads “from 7 to 0 Days ago”: the last 7 days up to the trigger time T. Leave the blank filter row under Filters (1) (3) empty, so every transaction counts; a blank row is not saved. Click Save Variable (4).
Figure 9.97 Time Window Days, from 7 to 0 Days ago, the blank filter row and Save Variable
Step 6Find the saved variable
The dialog closes. The new variable is the first row of the Variables list, with its Variable ID (VAR-08102026-000774 in the example) and its created time.
Figure 9.98 The new variable distinct_receivers_7d at the top of the Variables list
Step 7Check the View Variable page
Click the row to open View Variable. Check the type tag (1), STR_AGG_COUNT_DISTINCT; the CREATED and UPDATED lines (2), with the date and time and the user who saved it; Field, Function and Group by (3): receiver_entity_id, Count Distinct, sender_entity_id; the window (4), 7 to 0 Days ago; and the filters heading (5). Close the dialog with ×.
Figure 9.99 View Variable for distinct_receivers_7d: type STR_AGG_COUNT_DISTINCT, receiver_entity_id / Count Distinct / sender_entity_id
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Open Create Typology, name the rule and choose the type
Go to Transaction Monitoring → Typology and click + New. In Typology Name (1) type R05 Fan-out - one sender to 10 or more receivers in 7 days (letters, digits, spaces, hyphens, underscores and parentheses only). In Suppression Window (2) type 7 and choose Day. Type the description in Description (3). Open Typology type, type Cardin in Search typology type and click Cardinality (C-01).
Figure 9.100 Name, Suppression Window 7 Day and description entered; Typology type searched for Cardin
Step 9Check the details card
The type shows as a chip, Cardinality (C-01), with × to remove it. Typology type is a multi-select: after you pick a type the list stays open, hides the type you chose and shows “No typologies found” for the same search. Click anywhere outside the list to close it. A suitable description is “Flags a sender who pays 10 or more distinct receivers in 7 days.”
Figure 9.101 The Cardinality (C-01) chip in Typology type
Step 10Choose the variable in row 1
Below the card, Combine groups with is AND and Group 1 has MatchAND; one condition needs no change. In Group 1 click Select field next to WHEN, type part of the name, for example distinct, and click distinct_receivers_7d.
Figure 9.102 The Select field list searched by name: both distinct-count variables
Step 11Choose the operator
Open Select operator and choose Greater Than Equal. The row shows it as “Greater Than Equal (>...”. Greater Than Equal includes the threshold itself in the alert. The full operator list is in Part 4 of the walkthrough.
Figure 9.103 The operator list: choose Greater Than Equal
Step 12Keep Static Value and enter the threshold
Open the compare-to list: Static Value, Variable, and Ingested Data greyed out. Keep Static Value, because the threshold is a fixed number, and type 10 in Enter value. A sender with 10 or more different receivers in the window meets the condition.
Figure 9.104 The compare-to list: Static Value, Variable, Ingested Data greyed out
Step 13Check the whole form and click Next Step
The first page is complete: name (1), type chip (2), Suppression Window (3), description (4) and the condition (5). Next Step (6) is now available. Click it.
Figure 9.105 Create Typology complete: distinct_receivers_7d Greater Than Equal 10; Next Step available
Step 14Select the shared schedule
Review & schedule rule opens. Open Select Schedule, type the schedule name in Search Schedule and click the schedule created in Rule 1 (schedule_2027, SCH-08102026-000463 in the example). One schedule can drive many rules, so every example rule reuses it.
Figure 9.106 Select Schedule searched: the shared schedule and its SCH- ID
Step 15Check the schedule and save the draft
The schedule shows in Select Schedule (1). Its fields (2) are filled from the schedule: Execution Interval 1 Day, Start Time 01/01/2027 09:00 AM (the start at the time of the screenshot), no End Time. Leave them unchanged: they belong to the shared schedule. Click Save as Draft (3).
Figure 9.107 The shared schedule selected; Save as Draft available
Step 16Read the result
Wait a few seconds: the page title changes to Update Typology (1) and the card shows “This rule will run every 1 day starting 01 Jan 2027, 09:00:00 am” (2). Save as Draft is replaced by Update (3); Dry Run (4) and Activate (5) are now available. The rule is a Draft and does not run until it is activated; to test it, see Test a typology with Dry Run.
Figure 9.108 After Save as Draft: Update Typology, the run summary, Update, Dry Run and Activate
Step 17Check the rule page
Open the rule from Transaction Monitoring → Typology. The page shows the Draft chip and rule ID (1), TMR-08102026-001127, created 08 Oct 2026, 11:50:20 am. The summary strip (2) reads EXECUTION PERIOD 01 Jan 2027, 09:00:00 am → N/A, INTERVAL Every 1 day, COMPLEXITY Advanced, SUPPRESSION 7Day and TYPOLOGY Cardinality. Group 1 (3) shows distinct_receivers_7dGreater Than Equal (>=) 10. VARIABLES (4) shows the variable card: Str_agg_count_distinct, WINDOW in last 7 day, GROUPsender_entity_id.
Figure 9.109 The draft rule page: TMR-08102026-001127, Draft
How it evaluates. At each run the variable counts, for each sender, the different receivers paid in the last 7 days. Example: in the 7 days before a run:
Sender
Payments in the window
distinct_receivers_7d
Result
A
12 payments of ₱3,000, each to a different receiver
12
12 >= 10: alert
B
25 payments totalling ₱75,000, all to the same 4 receivers
4
4 >= 10 is false: no alert
C
10 payments to 10 different receivers
10
10 >= 10: alert (the threshold is included)
Amounts play no part in this rule: sender B moves more money than A but pays only 4 receivers.
Dry-run result. In testing, the rule created 240 alerts at its real threshold, 60 in each of the four windows.
Figure 9.110 Rule 5 dry run at >= 10: 240 alerts
Tuning. Choose the threshold (10) to suit how many receivers your customers normally pay: a remittance business that pays many beneficiaries may need a higher number, and a retail book a lower one. Choose the window (7 Days in the variable) and keep Suppression Window the same length or longer, as in the example. To ignore very small payments, add a filter to the variable, for example amountGreater Than Equal a value you choose; filters are shown in Rule 8.
Counts the different senders that paid the receiver in the last 7 days.
Window
7 to 0 Days
Threshold
≥ 10 senders
✓ Verified · 240 alerts
What it detects and why. One receiver is paid by 10 or more different senders within 7 days, for example ₱2,000 from each of fifteen unrelated people. Collecting funds from many sources into one account is typical of money-mule and pooling accounts.
Item
Setting
Variable distinct_senders_7d
The number of different senders (Count Distinct of sender_entity_id) that paid each receiver in the last 7 days (Group byreceiver_entity_id, from 7 to 0 Days ago). No filters.
Typology type
Cardinality (C-01)
Suppression Window
7 Day
Condition
distinct_senders_7dGreater Than Equal (>=) 10
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
This rule is the mirror of Rule 5: the counted field and the Group by field swap places. For a full description of each screen, see Build a typology from scratch.
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open Create Variables and name the variable
Go to Transaction Monitoring → Variables and click + New (the empty form is shown in Part 2 of the walkthrough). Leave Transaction selected (1): the variable is calculated from transactions. In Variable name (2) type distinct_senders_7d. In Description (3) type a note such as “Number of distinct senders per receiver in the last 7 days.” The description appears on the variable card of every typology that uses the variable.
Figure 9.111 Transaction selected, Variable name distinct_senders_7d and Description filled in
Step 2Choose the Field
Open Field and type sender_entity in Search Fields. Choose sender_entity_id. This is the value the variable counts: the ID of the customer who sent each transaction.
Figure 9.112 The Field list searched for sender_entity: choose sender_entity_id
Step 3Choose the Function
Open Function. For sender_entity_id the list offers Count, Count Distinct, Minimum and Maximum only. Choose Count Distinct. Each sender is counted once, however many times they paid the receiver.
Figure 9.113 The Function list for sender_entity_id: choose Count Distinct
Step 4Choose Group by
Open Group by and type receiver_entity in the search box. Choose receiver_entity_id. The count is calculated separately for each receiver, so the rule flags the receiving customer.
Figure 9.114 Group by searched for receiver_entity: choose receiver_entity_id
Step 5Set the time window and check the form
Scroll down to Time Window. Click Days (1); the default is Hours. In Analyze Transaction from enter 7 and in to enter 0 (2). The line reads “from 7 to 0 Days ago”: the last 7 days up to the trigger time T. Leave the blank filter row under Filters (1) (3) empty, so every transaction counts; a blank row is not saved. Click Save Variable (4).
Figure 9.115 Time Window Days, from 7 to 0 Days ago, the blank filter row and Save Variable
Step 6Find the saved variable
The dialog closes. The new variable is the first row of the Variables list, with its Variable ID (VAR-08102026-000775 in the example) and its created time.
Figure 9.116 The new variable distinct_senders_7d at the top of the Variables list
Step 7Check the View Variable page
Click the row to open View Variable. Check the type tag (1), STR_AGG_COUNT_DISTINCT; the CREATED and UPDATED lines (2), with the date and time and the user who saved it; Field, Function and Group by (3): sender_entity_id, Count Distinct, receiver_entity_id; the window (4), 7 to 0 Days ago; and the filters heading (5). Close the dialog with ×.
Figure 9.117 View Variable for distinct_senders_7d: type STR_AGG_COUNT_DISTINCT, sender_entity_id / Count Distinct / receiver_entity_id
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Open Create Typology, name the rule and choose the type
Go to Transaction Monitoring → Typology and click + New. In Typology Name (1) type R06 Fan-in - 10 or more senders to one receiver in 7 days (letters, digits, spaces, hyphens, underscores and parentheses only). In Suppression Window (2) type 7 and choose Day. Type the description in Description (3). Open Typology type, type Cardin in Search typology type and click Cardinality (C-01).
Figure 9.118 Name, Suppression Window 7 Day and description entered; Typology type searched for Cardin
Step 9Check the details card
The type shows as a chip, Cardinality (C-01), with × to remove it. Typology type is a multi-select: after you pick a type the list stays open, hides the type you chose and shows “No typologies found” for the same search. Click anywhere outside the list to close it. A suitable description is “Flags a receiver paid by 10 or more distinct senders in 7 days.”
Figure 9.119 The Cardinality (C-01) chip in Typology type
Step 10Choose the variable in row 1
Below the card, Combine groups with is AND and Group 1 has MatchAND; one condition needs no change. In Group 1 click Select field next to WHEN, type part of the name, for example distinct, and click distinct_senders_7d.
Figure 9.120 The Select field list searched by name: both distinct-count variables
Step 11Choose the operator
Open Select operator and choose Greater Than Equal. The row shows it as “Greater Than Equal (>...”. Greater Than Equal includes the threshold itself in the alert. The full operator list is in Part 4 of the walkthrough.
Figure 9.121 The operator list: choose Greater Than Equal
Step 12Keep Static Value and enter the threshold
Open the compare-to list: Static Value, Variable, and Ingested Data greyed out. Keep Static Value, because the threshold is a fixed number, and type 10 in Enter value. A receiver paid by 10 or more different senders in the window meets the condition.
Figure 9.122 The compare-to list: Static Value, Variable, Ingested Data greyed out
Step 13Check the whole form and click Next Step
The first page is complete: name (1), type chip (2), Suppression Window (3), description (4) and the condition (5). Next Step (6) is now available. Click it.
Figure 9.123 Create Typology complete: distinct_senders_7d Greater Than Equal 10; Next Step available
Step 14Select the shared schedule
Review & schedule rule opens. Open Select Schedule, type the schedule name in Search Schedule and click the schedule created in Rule 1 (schedule_2027, SCH-08102026-000463 in the example). One schedule can drive many rules, so every example rule reuses it.
Figure 9.124 Select Schedule searched: the shared schedule and its SCH- ID
Step 15Check the schedule and save the draft
The schedule shows in Select Schedule (1). Its fields (2) are filled from the schedule: Execution Interval 1 Day, Start Time 01/01/2027 09:00 AM (the start at the time of the screenshot), no End Time. Leave them unchanged: they belong to the shared schedule. Click Save as Draft (3).
Figure 9.125 The shared schedule selected; Save as Draft available
Step 16Read the result
Wait a few seconds: the page title changes to Update Typology (1) and the card shows “This rule will run every 1 day starting 01 Jan 2027, 09:00:00 am” (2). Save as Draft is replaced by Update (3); Dry Run (4) and Activate (5) are now available. The rule is a Draft and does not run until it is activated; to test it, see Test a typology with Dry Run.
Figure 9.126 After Save as Draft: Update Typology, the run summary, Update, Dry Run and Activate
Step 17Check the rule page
Open the rule from Transaction Monitoring → Typology. The page shows the Draft chip and rule ID (1), TMR-08102026-001128, created 08 Oct 2026, 11:51:57 am. The summary strip (2) reads EXECUTION PERIOD 01 Jan 2027, 09:00:00 am → N/A, INTERVAL Every 1 day, COMPLEXITY Advanced, SUPPRESSION 7Day and TYPOLOGY Cardinality. Group 1 (3) shows distinct_senders_7dGreater Than Equal (>=) 10. VARIABLES (4) shows Str_agg_count_distinct, WINDOW in last 7 day, GROUPreceiver_entity_id.
Figure 9.127 The draft rule page: TMR-08102026-001128, Draft
How it evaluates. At each run the variable counts, for each receiver, the different senders that paid it in the last 7 days.
Receiver
Payments in the window
distinct_senders_7d
Result
D
15 payments of about ₱2,000, from 15 different senders
15
15 >= 10: alert
E
A salary of ₱40,000 from one employer and 6 transfers from 3 relatives
4
4 >= 10 is false: no alert
Dry-run result. In testing, the rule created 240 alerts at its real threshold, 60 in each of the four windows.
Figure 9.128 Rule 6 dry run at >= 10: 240 alerts
Tuning. Choose the threshold (10) from how many senders your receiving customers normally have; merchants, collection accounts and charities receive from many payers, so you may exclude them with a filter or use a higher number. Choose the window length and keep the suppression window at least as long. To count only payments above a size you choose, add an amount filter to the variable.
Takes the sender's largest single amount in the last day.
Window
1 to 0 Days
Threshold
≥ ₱1,000,000
✓ Verified by positive control
What it detects and why. This rule flags a sender who makes one transaction of ₱1,000,000 or more within a day. One very large payment is reviewed on its own, whatever else the customer does, which is why the variable takes the largest amount rather than the total (Rule 3 looks at totals).
Item
Setting
Variable max_amount_1d
Maximum of amount, grouped by sender_entity_id, Days from 1 to 0, no filters
Typology type
Large Transaction (LT-01)
Suppression Window
1 Day
Condition
Group 1, Match AND: max_amount_1dGreater Than Equal (>=) Static Value 1000000
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type max_amount_1d in Variable name (1) and a description such as “Largest single transaction amount per sender in the last 1 day.” (2).
Figure 9.129 Rule 7 variable: name and description
Step 2Choose the Field: amount
Open Field, type amount and choose amount, the first of four matches.
Figure 9.130 Field search for amount
Step 3Choose the Function: Maximum
Open Function. For a numeric field the list offers Count, Count Distinct, Sum, Average, Minimum and Maximum. Choose Maximum: the variable keeps the largest single amount, not the total.
Figure 9.131 Function: Maximum
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the largest amount is calculated separately for each sender.
Figure 9.132 Group by search: sender_entity_id
Step 5Set the time window: Days, 1 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 1 in Analyze Transaction from and 0 in to (2): the 1 day up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.133 Time window 1 to 0 Days ago, blank filter row and Save Variable
Step 6Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000796.
Figure 9.134 Rule 7 variable in the Variables list
Step 7Check the saved variable
Click the row. View Variable shows the type tag NUM_AGG_MAX (1), the CREATED and UPDATED times and user (2), amount / Maximum / sender_entity_id (3), 1 to 0 Days ago (4) and Filters (0) (5).
Figure 9.135 View Variable for max_amount_1d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Fill in the details and choose Large Transaction
Click + New on Typology. Type the name R09 Large single transaction - PHP 1000000 or more in one transaction in 1 day (1). Set Suppression Window to 1 and choose Day (2): the window is one day. Write a description (3). Open Typology type (4), type Large and click Large Transaction LT-01.
Figure 9.136 Rule 7 details and the Typology type search
Step 9Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click max_amount_1d.
Figure 9.137 Rule 7 row 1: variable search
Step 10Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.138 Rule 7 row 1: operator list
Step 11Enter 1000000 and go to the next step
Type 1000000 in Enter value. Check the name (1), the type chip Large Transaction (LT-01) (2), 1 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.139 The completed Rule 7 page
Part C: Choose the schedule and save
Step 12Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule (1), search for schedule_2027 and click it. Its fields fill in (2); leave them unchanged, because they belong to the shared schedule. The screenshot was taken before the start was moved to 09 Oct 2026, so it shows 01/01/2027. Click Save as Draft (3).
Figure 9.140 The shared schedule selected; Save as Draft
Step 13Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.141 Rule 7 after Save as Draft
Step 14Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID TMR-08102026-001131, created 08 Oct 2026, 05:15:18 pm (1); the summary with INTERVAL Every 1 day, SUPPRESSION 1Day and TYPOLOGY Large Transaction (2); the condition, with the operator shown as Greater Than Equal (>=) (3); and the variable card max_amount_1d, Num_agg_max, WINDOW in last 1 day, GROUPsender_entity_id (4).
Figure 9.142 The saved Rule 7 as a Draft, TMR-08102026-001131
How it evaluates. At each daily run the variable takes, for each sender, the largest single amount in the last day. Sender A sent ₱1,200,000 once and ₱5,000 twice: the maximum is ₱1,200,000, so the rule alerts. Sender B sent ₱600,000 twice (₱1,200,000 in total): the maximum is ₱600,000, so there is no alert from this rule.
Dry-run result. In testing, the rule created 0 alerts at its real threshold (>= 1000000) in all four windows: the test data has no single transaction of ₱1,000,000 or more. To prove the rule works, the threshold was lowered to >= 1 for one dry run. That created 764 alerts (0 / 0 / 500 / 264 by window, newest first), then the threshold was restored and a new dry run returned 0 again. See Test a typology with Dry Run for the method.
Tuning. Set the amount (1000000) from the size of payment you want reviewed individually. A longer window (for example 7 to 0 Days) catches the same payment on more runs, so keep the Suppression Window at least as long as the window.
Counts the sender's transactions under ₱1,000 in the last day.
Window
1 to 0 Days
Threshold
≥ 20 under ₱1,000
✓ Verified by positive control
What it detects and why. This rule flags a sender who makes 20 or more transactions under ₱1,000 in one day. Many very small payments in a short time can be a way to move money in amounts that do not stand out one by one.
Item
Setting
Variable small_txn_count_1d
Count of id, grouped by sender_entity_id, Days from 1 to 0, filter amountLess Than 1000
Typology type
Structuring (TP100)
Suppression Window
1 Day
Condition
Group 1, Match AND: small_txn_count_1dGreater Than Equal (>=) Static Value 20
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type small_txn_count_1d in Variable name (1) and a description such as “Number of transactions under PHP 1000 per sender in the last 1 day.” (2).
Figure 9.144 Rule 8 variable: name and description
Step 2Choose the Field: id
Open Field, type id and choose id, the first match. Counting id counts transactions.
Figure 9.145 Field search for id
Step 3Choose the Function: Count
Open Function. For an ID or text field the list offers Count, Count Distinct, Minimum and Maximum. Choose Count.
Figure 9.146 Function: Count
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the count is calculated separately for each sender.
Figure 9.147 Group by search: sender_entity_id
Step 5Add the filter: choose the amount field
Scroll to Filters (1). In the blank row open Field (1), type amount and choose amount. The filter decides which transactions are counted.
Figure 9.148 Filter row: the field search for amount
Step 6Choose Less Than and type 1000
Open Operator... and choose Less Than, then type 1000 in Enter value and keep Static. ₱1,000 itself is not counted.
Figure 9.149 Filter operators: Less Than
Step 7Set the time window: Days, 1 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 1 in Analyze Transaction from and 0 in to (2): the 1 day up to the trigger time T. The filter row (3) reads amountLess Than 1000, Static. Click Save Variable (4).
Figure 9.150 Time window 1 to 0 Days ago, the amount filter and Save Variable
Step 8Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000797.
Figure 9.151 Rule 8 variable in the Variables list
Step 9Check the saved variable
Click the row. View Variable shows the type tag STR_AGG_COUNT (1), the CREATED and UPDATED times and user (2), id / Count / sender_entity_id (3), 1 to 0 Days ago (4) and the saved filter, amountLess Than 1000 (5).
Figure 9.152 View Variable for small_txn_count_1d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 10Fill in the details and choose Structuring
Click + New on Typology. Type the name R10 Smurfing - 20 or more transactions under PHP 1000 in 1 day (1). Set Suppression Window to 1 and choose Day (2): the window is one day. Write a description (3). Open Typology type (4), type Struct and click Structuring TP100.
Figure 9.153 Rule 8 details and the Typology type search
Step 11Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click small_txn_count_1d.
Figure 9.154 Rule 8 row 1: variable search
Step 12Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.155 Rule 8 row 1: operator list
Step 13Enter 20 and go to the next step
Type 20 in Enter value. Check the name (1), the type chip Structuring (TP100) (2), 1 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.156 The completed Rule 8 page
Part C: Choose the schedule and save
Step 14Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 15Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.157 Rule 8 after Save as Draft
Step 16Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID TMR-08102026-001132, created 08 Oct 2026, 05:17:54 pm (1); the summary with INTERVAL Every 1 day, SUPPRESSION 1Day and TYPOLOGY Structuring (2); the condition, with the operator shown as Greater Than Equal (>=) (3); and the variable card small_txn_count_1d, Str_agg_count, WINDOW in last 1 day, GROUPsender_entity_id (4). The card does not show the variable’s filter; check it on View Variable.
Figure 9.158 The saved Rule 8 as a Draft, TMR-08102026-001132
How it evaluates. At each run the variable counts, for each sender, the transactions under ₱1,000 in the last day. Sender A made 25 payments of ₱500: 25 >= 20, alert. Sender B made 30 payments, 15 of them under ₱1,000: the count is 15, no alert.
Dry-run result. In testing, the rule created 0 alerts at its real threshold (>= 20) in all four windows: the test data has transactions under ₱1,000, but no sender with 20 of them in a day. To prove the rule works, the threshold was lowered to >= 1 for one dry run. That created 339 alerts (0 / 0 / 194 / 145 by window, newest first), then the threshold was restored and a new dry run returned 0 again. See Test a typology with Dry Run for the method.
Tuning. You can change the small-amount limit (the filter value 1000), the count (20) and the window. A higher limit or a lower count raises more alerts.
Red flagA week that is large against the sender’s 90 days
Logic
Compares the sender's 7-day total with their 90-day total.
Window
7 to 0 Days and 90 to 0 Days
Threshold
7-day ≥ ₱100,000 AND ≥ 0.5 × 90-day
✓ Verified · 42 alerts
What it detects and why. This rule compares a sender with their own past. It flags a sender who sent ₱100,000 or more in the last 7 days when that is at least half of everything they sent in the last 90 days. A sudden jump against a customer’s own baseline can matter even when the amount is ordinary for other customers.
Item
Setting
Variable A sent_sum_7d_spike
Sum of amount, grouped by sender_entity_id, Days from 7 to 0
Variable B sent_sum_90d
Sum of amount, grouped by sender_entity_id, Days from 90 to 0
Typology type
Anomaly (TP103)
Suppression Window
7 Day
Conditions
Group 1, Match AND: sent_sum_7d_spikeGreater Than Equal (>=) Static Value 100000 AND sent_sum_7d_spikeGreater Than Equal (>=) Variable sent_sum_90d, THAN MULTIPLIER 0.5
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create variable A, the recent total
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name variable A
Click + New on Variables. Type sent_sum_7d_spike (1) and a description such as “Total amount sent per sender in the last 7 days.” (2).
Figure 9.160 Variable A: name and description
Step 2Choose amount and Sum
Open Field and choose amount. Open Function and choose Sum. Then open Group by and choose sender_entity_id, as in Rule 7.
Figure 9.161 Variable A: Function Sum
Step 3Set the window: Days, 7 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 7 in Analyze Transaction from and 0 in to (2): the 7 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.162 Variable A: window 7 to 0 Days ago and Save Variable
Step 4Check variable A
The variable is listed as VAR-08102026-000798. Click the row. View Variable shows the type tag NUM_AGG_SUM (1), the CREATED and UPDATED times and user (2), amount / Sum / sender_entity_id (3), 7 to 0 Days ago (4) and Filters (0) (5).
Figure 9.163 View Variable for variable A
Part B: Create variable B, the sender’s own baseline
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 5Open the form and name variable B
Click + New again. Type sent_sum_90d (1) and a description such as “Total amount sent per sender in the last 90 days (the sender’s own baseline).” (2).
Figure 9.164 Variable B: name and description
Step 6Choose amount, Sum and sender_entity_id; set 90 to 0 and save
Choose amount, Sum and sender_entity_id, as for variable A. Scroll down. Click Days (1); the default is Hours. Enter 90 in Analyze Transaction from and 0 in to (2): the 90 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.165 Variable B: window 90 to 0 Days ago and Save Variable
Step 7Find variable B in the list
Variable B is the first row, here VAR-08102026-000799.
Figure 9.166 Variable B in the Variables list
Step 8Check variable B
Click the row. View Variable shows the type tag NUM_AGG_SUM (1), the CREATED and UPDATED times and user (2), amount / Sum / sender_entity_id (3), 90 to 0 Days ago (4) and Filters (0) (5).
Figure 9.167 View Variable for variable B
Part C: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 9Fill in the details; keep the name to 100 characters
Click + New on Typology. Set Suppression Window to 7 Day, write a description, and in Typology type search TP103 and click Anomaly. Names are limited to 100 characters: the first name tried for this example was longer, and Next Step stopped with “Rule name must be 3-100 characters” under Typology Name. The final name is R11 Spike vs own history - PHP 100000 or more in 7 days and half of 90-day total.
Figure 9.168 A name over 100 characters: Rule name must be 3-100 characters
Step 10Row 1: variable A Greater Than Equal 100000
In Group 1, click Select field, type sent_sum and click sent_sum_7d_spike. Choose Greater Than Equal, keep Static Value and type 100000.
Figure 9.169 Row 1: choose variable A
Step 11Add row 2
Click Add Condition. A second row appears, joined to the first by AND — all must match (1). In row 2 (2) choose sent_sum_7d_spike again and Greater Than Equal.
Figure 9.170 Row 2 added, joined by AND — all must match
Step 12Row 2: compare with variable B
In row 2 open the compare-to list and choose Variable (1). Select variable (2) lists the variables, newest first, without a search box and without the row’s own variable. Choose sent_sum_90d.
Figure 9.171 Row 2: compare with a Variable, the Select variable list
Step 13Enter the multiplier 0.5 and go to the next step
Type 0.5 in THAN MULTIPLIER. Row 2 now means “the 7-day total is at least half of the 90-day total”. Check the name (1), Anomaly (TP103) (2), 7 Day (3), row 1 (4) and row 2 (5), then click Next Step (6).
Figure 9.172 The completed Rule 9 page with two conditions
Part D: Choose the schedule and save
Step 14Select the shared schedule and save the draft
Open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 15Check the saved draft
The page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6).
Figure 9.173 Rule 9 after Save as Draft
Step 16Check the rule page
The rule page shows Draft TMR-08102026-001133 (1), SUPPRESSION 7Day and TYPOLOGY Anomaly (2), both conditions, the second reading “sent_sum_90d (multiplied by 0.5)” (3), and both variable cards, in last 90 day and in last 7 day (4).
Figure 9.174 The saved Rule 9 as a Draft, TMR-08102026-001133
How it evaluates. The 90-day total includes the last 7 days. Sender A sent ₱150,000 in the last 7 days and ₱200,000 in 90 days: ₱150,000 >= 100000 and ₱150,000 >= 0.5 × ₱200,000, so the rule alerts. Sender B sent ₱150,000 in 7 days but ₱1,000,000 in 90 days: ₱150,000 is below ₱500,000, no alert. Sender C sent ₱40,000 in 7 days and ₱50,000 in 90 days: row 1 fails, no alert.
Dry-run result. In testing, the rule created 42 alerts at its real thresholds: 0, 6, 16 and 20 across the four windows, newest first.
Figure 9.175 Rule 9 dry run: 42 alerts
Tuning. Raise the minimum (100000) to ignore small spikes, and change the multiplier: 0.5 means half of the 90-day total; 0.3 is broader. Keep both variables grouped by sender_entity_id so they describe the same sender.
Counts the different devices (sender_device_id) the sender used in the last 7 days.
Window
7 to 0 Days
Threshold
≥ 3 devices
✓ Verified by positive control
What it detects and why. This rule flags a sender who used 3 or more different devices in 7 days. A customer account operated from many devices can mean that others are using it, as with a shared or rented mule account.
Item
Setting
Variable distinct_devices_7d
Count Distinct of sender_device_id, grouped by sender_entity_id, Days from 7 to 0, no filters
Typology type
Anomaly (TP103)
Suppression Window
7 Day
Condition
Group 1, Match AND: distinct_devices_7dGreater Than Equal (>=) Static Value 3
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type distinct_devices_7d in Variable name (1) and a description such as “Number of distinct sender devices per sender in the last 7 days.” (2).
Figure 9.176 Rule 10 variable: name and description
Step 2Choose the Field: sender_device_id
Open Field and type device. Two fields match, receiver_device_id and sender_device_id. Choose sender_device_id.
Figure 9.177 Field search for device: choose sender_device_id
Step 3Choose the Function: Count Distinct
Open Function. For an ID or text field the list offers Count, Count Distinct, Minimum and Maximum. Choose Count Distinct: each different value is counted once.
Figure 9.178 Function: Count Distinct
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the count is calculated separately for each sender.
Figure 9.179 Group by search: sender_entity_id
Step 5Set the time window: Days, 7 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 7 in Analyze Transaction from and 0 in to (2): the 7 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.180 Time window 7 to 0 Days ago, blank filter row and Save Variable
Step 6Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000800.
Figure 9.181 Rule 10 variable in the Variables list
Step 7Check the saved variable
Click the row. View Variable shows the type tag STR_AGG_COUNT_DISTINCT (1), the CREATED and UPDATED times and user (2), sender_device_id / Count Distinct / sender_entity_id (3), 7 to 0 Days ago (4) and Filters (0) (5).
Figure 9.182 View Variable for distinct_devices_7d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Fill in the details and choose Anomaly
Click + New on Typology. Type the name R12 Many devices - 3 or more sender devices in 7 days (1). Set Suppression Window to 7 and choose Day (2): it matches the 7-day window. Write a description (3). Open Typology type (4), type TP103 and click Anomaly TP103.
Figure 9.183 Rule 10 details and the Typology type search
Step 9Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click distinct_devices_7d.
Figure 9.184 Rule 10 row 1: variable search
Step 10Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.185 Rule 10 row 1: operator list
Step 11Enter 3 and go to the next step
Type 3 in Enter value. Check the name (1), the type chip Anomaly (TP103) (2), 7 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.186 The completed Rule 10 page
Part C: Choose the schedule and save
Step 12Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 13Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.187 Rule 10 after Save as Draft
Step 14Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID TMR-08102026-001134, created 08 Oct 2026, 05:24:06 pm (1); the summary with INTERVAL Every 1 day, SUPPRESSION 7Day and TYPOLOGY Anomaly (2); the condition, with the operator shown as NUM_GTE (>=) (3); and the variable card distinct_devices_7d, Str_agg_count_distinct, WINDOW in last 7 day, GROUPsender_entity_id (4).
Figure 9.188 The saved Rule 10 as a Draft, TMR-08102026-001134
How it evaluates. Sender A sent 6 payments in 7 days from 4 different devices: 4 >= 3, alert. Sender B sent 40 payments from the same 2 devices: 2, no alert.
Dry-run result. In testing, the rule created 0 alerts at its real threshold (>= 3) in all four windows: in the test data each sender used 1 or 2 devices. To prove the rule works, the threshold was lowered to >= 1 for one dry run. That created 4,043 alerts (1,046 / 1,059 / 1,061 / 877 by window, newest first), then the threshold was restored and a new dry run returned 0 again. See Test a typology with Dry Run for the method.
Tuning. Set the number of devices from what is normal for your customers; a household or a business may use several. Keep the Suppression Window at least as long as the window.
Red flagOne account used from many network locations
Logic
Counts the different IP addresses (sender_ip) the sender used in the last 7 days.
Window
7 to 0 Days
Threshold
≥ 15 IP addresses
✓ Verified · 120 alerts
What it detects and why. This rule flags a sender who used 15 or more different IP addresses in 7 days. Logging in from many network locations in a short time can mean the account is being operated by several people or through changing connections.
Item
Setting
Variable distinct_ips_7d
Count Distinct of sender_ip, grouped by sender_entity_id, Days from 7 to 0, no filters
Typology type
Anomaly (TP103)
Suppression Window
7 Day
Condition
Group 1, Match AND: distinct_ips_7dGreater Than Equal (>=) Static Value 15
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type distinct_ips_7d in Variable name (1) and a description such as “Number of distinct sender IP addresses per sender in the last 7 days.” (2).
Figure 9.190 Rule 11 variable: name and description
Step 2Choose the Field: sender_ip
Open Field and type _ip. Two fields match, receiver_ip and sender_ip. Choose sender_ip.
Figure 9.191 Field search for _ip: choose sender_ip
Step 3Choose the Function: Count Distinct
Open Function. For an ID or text field the list offers Count, Count Distinct, Minimum and Maximum. Choose Count Distinct: each different value is counted once.
Figure 9.192 Function: Count Distinct
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the count is calculated separately for each sender.
Figure 9.193 Group by search: sender_entity_id
Step 5Set the time window: Days, 7 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 7 in Analyze Transaction from and 0 in to (2): the 7 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.194 Time window 7 to 0 Days ago, blank filter row and Save Variable
Step 6Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000801.
Figure 9.195 Rule 11 variable in the Variables list
Step 7Check the saved variable
Click the row. View Variable shows the type tag STR_AGG_COUNT_DISTINCT (1), the CREATED and UPDATED times and user (2), sender_ip / Count Distinct / sender_entity_id (3), 7 to 0 Days ago (4) and Filters (0) (5).
Figure 9.196 View Variable for distinct_ips_7d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Fill in the details and choose Anomaly
Click + New on Typology. Type the name R13 Many IPs - 15 or more sender IP addresses in 7 days, set Suppression Window to 7 and choose Day, and write a description. Open Typology type, type TP103 and click Anomaly TP103. The screens are the same as in Rule 10; the example was first saved with the name and threshold for 5 IP addresses, then changed to 15 after the dry run (see Test a typology with Dry Run).
Step 9Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click distinct_ips_7d.
Figure 9.197 Rule 11 row 1: variable search
Step 10Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.198 Rule 11 row 1: operator list
Step 11Enter 15 and go to the next step
Type 15 in Enter value and click Next Step. In the list of typologies the rule then shows its name, R13 Many IPs - 15 or more sender IP addresses in 7 days, with Draft and its rule ID, TMR-08102026-001135.
Figure 9.199 The Rule 11 example in the typology list, with its final name
Part C: Choose the schedule and save
Step 12Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 13Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.200 Rule 11 after Save as Draft
Step 14Check the rule page
Open the rule from Transaction Monitoring → Typology to check it, as in Rule 10. It is listed as Draft, TMR-08102026-001135, with the typology type Anomaly.
How it evaluates. Sender A used 18 IP addresses in 7 days: 18 >= 15, alert. Sender B used 6: no alert.
Dry-run result. The threshold was set from the dry run. At 5 IP addresses the rule created 758 alerts across the four windows, far too many to review; at 10 it created 240, at 20 none, and at 15 it created 120 (30 in each window). The rule was saved at 15 and renamed to match. The tuning steps are in Test a typology with Dry Run.
Figure 9.201 Rule 11 at the final threshold, >= 15: 120 alerts
Tuning. Mobile customers can change IP address often, so set the threshold from a dry run on your own data, as shown for this rule, rather than from a fixed number.
Red flagPayments funded from many cards or accounts
Logic
Counts the different instruments (sender_instrument_id) the sender paid from in the last 7 days.
Window
7 to 0 Days
Threshold
≥ 5 instruments
✓ Verified by positive control
What it detects and why. This rule flags a sender who paid from 5 or more different instruments (for example cards or accounts) in 7 days. Funding payments from many instruments can hide where the money comes from.
Item
Setting
Variable distinct_instruments_7d
Count Distinct of sender_instrument_id, grouped by sender_entity_id, Days from 7 to 0, no filters
Typology type
Cardinality (C-01)
Suppression Window
7 Day
Condition
Group 1, Match AND: distinct_instruments_7dGreater Than Equal (>=) Static Value 5
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type distinct_instruments_7d in Variable name (1) and a description such as “Number of distinct sender instruments (cards or accounts) per sender in the last 7 days.” (2).
Figure 9.202 Rule 12 variable: name and description
Step 2Choose the Field: sender_instrument_id
Open Field and type instrument. The matches include receiver_instrument_id, receiver_instrument_subtype, receiver_instrument_type and sender_instrument_id. Choose sender_instrument_id.
Figure 9.203 Field search for instrument: choose sender_instrument_id
Step 3Choose the Function: Count Distinct
Open Function. For an ID or text field the list offers Count, Count Distinct, Minimum and Maximum. Choose Count Distinct: each different value is counted once.
Figure 9.204 Function: Count Distinct
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the count is calculated separately for each sender.
Figure 9.205 Group by search: sender_entity_id
Step 5Set the time window: Days, 7 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 7 in Analyze Transaction from and 0 in to (2): the 7 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.206 Time window 7 to 0 Days ago, blank filter row and Save Variable
Step 6Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000802.
Figure 9.207 Rule 12 variable in the Variables list
Step 7Check the saved variable
Click the row. View Variable shows the type tag STR_AGG_COUNT_DISTINCT (1), the CREATED and UPDATED times and user (2), sender_instrument_id / Count Distinct / sender_entity_id (3), 7 to 0 Days ago (4) and Filters (0) (5).
Figure 9.208 View Variable for distinct_instruments_7d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Fill in the details and choose Cardinality
Click + New on Typology. Type the name R14 Many instruments - 5 or more sender instruments in 7 days (1). Set Suppression Window to 7 and choose Day (2): it matches the 7-day window. Write a description (3). Open Typology type (4), type Cardin and click Cardinality C-01.
Figure 9.209 Rule 12 details and the Typology type search
Step 9Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click distinct_instruments_7d.
Figure 9.210 Rule 12 row 1: variable search
Step 10Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.211 Rule 12 row 1: operator list
Step 11Enter 5 and go to the next step
Type 5 in Enter value. Check the name (1), the type chip Cardinality (C-01) (2), 7 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.212 The completed Rule 12 page
Part C: Choose the schedule and save
Step 12Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 13Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.213 Rule 12 after Save as Draft
Step 14Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID TMR-08102026-001136, created 08 Oct 2026, 05:28:28 pm (1); the summary with INTERVAL Every 1 day, SUPPRESSION 7Day and TYPOLOGY Cardinality (2); the condition, with the operator shown as Greater Than Equal (>=) (3); and the variable card distinct_instruments_7d, Str_agg_count_distinct, WINDOW in last 7 day, GROUPsender_entity_id (4).
Figure 9.214 The saved Rule 12 as a Draft, TMR-08102026-001136
How it evaluates. Sender A paid from 6 different cards in a week: 6 >= 5, alert. Sender B paid 30 times from 1 account: no alert.
Dry-run result. In testing, the rule created 0 alerts at its real threshold (>= 5) in all four windows: no sender in the test data used 5 instruments in 7 days. To prove the rule works, the threshold was lowered to >= 1 for one dry run. That created 4,615 alerts (1,164 / 1,187 / 1,222 / 1,042 by window, newest first), then the threshold was restored and a new dry run returned 0 again. See Test a typology with Dry Run for the method.
Tuning. Set the number of instruments from what your customers normally hold. To count only one kind of instrument, add a filter on sender_instrument_type.
Counts the different currencies (currency_code) the sender used in the last 30 days.
Window
30 to 0 Days
Threshold
≥ 3 currencies
✓ Verified by positive control
What it detects and why. This rule flags a sender who transacted in 3 or more different currencies in 30 days. Frequent switching between currencies is unusual for most retail customers and can be part of moving value across borders.
Item
Setting
Variable distinct_currencies_30d
Count Distinct of currency_code, grouped by sender_entity_id, Days from 30 to 0, no filters
Typology type
Anomaly (TP103)
Suppression Window
30 Day
Condition
Group 1, Match AND: distinct_currencies_30dGreater Than Equal (>=) Static Value 3
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type distinct_currencies_30d in Variable name (1) and a description such as “Number of distinct transaction currencies per sender in the last 30 days.” (2).
Figure 9.216 Rule 13 variable: name and description
Step 2Choose the Field: currency_code
Open Field and type currency. The matches are currency_code, orig_currency_amount, orig_currency_code, receiver_currency_code and sender_currency_code. Choose currency_code.
Figure 9.217 Field search for currency: choose currency_code
Step 3Choose the Function: Count Distinct
Open Function. For an ID or text field the list offers Count, Count Distinct, Minimum and Maximum. Choose Count Distinct: each different value is counted once.
Figure 9.218 Function: Count Distinct
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the count is calculated separately for each sender.
Figure 9.219 Group by search: sender_entity_id
Step 5Set the time window: Days, 30 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 30 in Analyze Transaction from and 0 in to (2): the 30 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.220 Time window 30 to 0 Days ago, blank filter row and Save Variable
Step 6Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000803.
Figure 9.221 Rule 13 variable in the Variables list
Step 7Check the saved variable
Click the row. View Variable shows the type tag STR_AGG_COUNT_DISTINCT (1), the CREATED and UPDATED times and user (2), currency_code / Count Distinct / sender_entity_id (3), 30 to 0 Days ago (4) and Filters (0) (5).
Figure 9.222 View Variable for distinct_currencies_30d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Fill in the details and choose Anomaly
Click + New on Typology. Type the name R15 Many currencies - 3 or more currencies in 30 days (1). Set Suppression Window to 30 and choose Day (2): it matches the 30-day window. Write a description (3). Open Typology type (4), type TP103 and click Anomaly TP103.
Figure 9.223 Rule 13 details and the Typology type search
Step 9Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click distinct_currencies_30d.
Figure 9.224 Rule 13 row 1: variable search
Step 10Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.225 Rule 13 row 1: operator list
Step 11Enter 3 and go to the next step
Type 3 in Enter value. Check the name (1), the type chip Anomaly (TP103) (2), 30 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.226 The completed Rule 13 page
Part C: Choose the schedule and save
Step 12Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 13Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.227 Rule 13 after Save as Draft
Step 14Check the rule page
Open the rule from Transaction Monitoring → Typology. The page has the same layout as in Rule 12: Draft with the rule ID TMR-08102026-001137, SUPPRESSION 30Day, TYPOLOGY Anomaly, the condition and the variable card.
How it evaluates. Sender A sent payments in PHP, USD and EUR within 30 days: 3 >= 3, alert. Sender B paid only in PHP: 1, no alert.
Dry-run result. In testing, the rule created 0 alerts at its real threshold (>= 3) in all four windows: no sender in the test data used 3 currencies in 30 days. To prove the rule works, the threshold was lowered to >= 1 for one dry run. That created 6,512 alerts (1,671 / 1,680 / 1,685 / 1,476 by window, newest first), then the threshold was restored and a new dry run returned 0 again. See Test a typology with Dry Run for the method. This control shows that currency_code is filled in for every sender; with only one currency per sender in the test data, it cannot show a sender with several currencies.
Counts the different destination countries (receiver_provider_country) the sender paid into in the last 30 days.
Window
30 to 0 Days
Threshold
≥ 3 countries
✓ Verified · 94 alerts
What it detects and why. This rule flags a sender who paid receivers in 3 or more different provider countries in 30 days. Spreading payments across many countries is a common way to move funds out of reach.
Item
Setting
Variable distinct_dest_countries_30d
Count Distinct of receiver_provider_country, grouped by sender_entity_id, Days from 30 to 0, no filters
Typology type
Anomaly (TP103)
Suppression Window
30 Day
Condition
Group 1, Match AND: distinct_dest_countries_30dGreater Than Equal (>=) Static Value 3
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type distinct_dest_countries_30d in Variable name (1) and a description such as “Number of distinct receiver provider countries per sender in the last 30 days.” (2).
Figure 9.229 Rule 14 variable: name and description
Step 2Choose the Field: receiver_provider_country
Open Field and type country. Two fields match, receiver_provider_country and sender_provider_country. Choose receiver_provider_country.
Figure 9.230 Field search for country: choose receiver_provider_country
Step 3Choose the Function: Count Distinct
Open Function. For an ID or text field the list offers Count, Count Distinct, Minimum and Maximum. Choose Count Distinct: each different value is counted once.
Figure 9.231 Function: Count Distinct
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the count is calculated separately for each sender.
Figure 9.232 Group by search: sender_entity_id
Step 5Set the time window: Days, 30 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 30 in Analyze Transaction from and 0 in to (2): the 30 days up to the trigger time T. Leave the blank row under Filters (1) (3) empty: a blank row is dropped when you save. Click Save Variable (4).
Figure 9.233 Time window 30 to 0 Days ago, blank filter row and Save Variable
Step 6Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000804.
Figure 9.234 Rule 14 variable in the Variables list
Step 7Check the saved variable
Click the row. View Variable shows the type tag STR_AGG_COUNT_DISTINCT (1), the CREATED and UPDATED times and user (2), receiver_provider_country / Count Distinct / sender_entity_id (3), 30 to 0 Days ago (4) and Filters (0) (5).
Figure 9.235 View Variable for distinct_dest_countries_30d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 8Fill in the details and choose Anomaly
Click + New on Typology. Type the name R16 Many destination countries - 3 or more receiver countries in 30 days (1). Set Suppression Window to 30 and choose Day (2): it matches the 30-day window. Write a description (3). Open Typology type (4), type TP103 and click Anomaly TP103.
Figure 9.236 Rule 14 details and the Typology type search
Step 9Choose the variable in row 1
In Group 1, click Select field next to WHEN, type part of the name and click distinct_dest_countries_30d.
Figure 9.237 Rule 14 row 1: variable search
Step 10Choose Greater Than Equal and keep Static Value
Open Select operator and choose Greater Than Equal. Keep Static Value in the compare-to list: the threshold is a fixed number.
Figure 9.238 Rule 14 row 1: operator list
Step 11Enter 3 and go to the next step
Type 3 in Enter value. Check the name (1), the type chip Anomaly (TP103) (2), 30 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.239 The completed Rule 14 page
Part C: Choose the schedule and save
Step 12Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 13Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.240 Rule 14 after Save as Draft
Step 14Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID TMR-08102026-001138, created 08 Oct 2026, 06:39:17 pm (1); the summary with INTERVAL Every 1 day, SUPPRESSION 30Day and TYPOLOGY Anomaly (2); the condition, with the operator shown as Greater Than Equal (>=) (3); and the variable card distinct_dest_countries_30d, Str_agg_count_distinct, WINDOW in last 30 day, GROUPsender_entity_id (4).
Figure 9.241 The saved Rule 14 as a Draft, TMR-08102026-001138
How it evaluates. Sender A paid receivers in 4 countries within 30 days: 4 >= 3, alert. Sender B paid 20 receivers, all in 1 country: no alert.
Dry-run result. In testing, the rule created 94 alerts at its real threshold: 31, 31, 31 and 1 across the four windows, newest first.
Figure 9.242 Rule 14 dry run at >= 3: 94 alerts
Tuning. Set the number of countries from your customers’ normal corridors, and check the volume with a dry run.
Adds up the amount the sender sent to a country other than their own in the last 30 days.
Window
30 to 0 Days
Threshold
≥ ₱1,000,000
✓ Verified by positive control
What it detects and why. This rule flags a sender who sent ₱1,000,000 or more abroad within 30 days, counting only payments whose receiver’s provider country differs from the sender’s. It separates cross-border value from domestic value.
Item
Setting
Variable crossborder_sum_30d
Sum of amount, grouped by sender_entity_id, Days from 30 to 0, filter receiver_provider_countryNot Equalsender_provider_country (Dynamic)
Typology type
High Value (HV01)
Suppression Window
30 Day
Condition
Group 1, Match AND: crossborder_sum_30dGreater Than Equal (>=) Static Value 1000000
Schedule
Existing schedule_2027 (created in Rule 1): every 1 Day, starting 09 Oct 2026, 09:00 AM, no end time
Part A: Create the variable
Fyscal ARCX→Transaction Monitoring→Variables→+ New
Step 1Open the form and name the variable
Click + New on Variables and leave Transaction selected. Type crossborder_sum_30d in Variable name (1) and a description such as “Total amount sent per sender in the last 30 days where the receiver provider country differs from the sender provider country.” (2).
Figure 9.243 Rule 15 variable: name and description
Step 2Choose the Field: amount
Open Field, type amount and choose amount, as in Rule 7.
Step 3Choose the Function: Sum
Open Function and choose Sum to add the amounts together.
Figure 9.244 Function: Sum
Step 4Choose Group by: sender_entity_id
Open Group by, type sender_entity in Search Fields and choose sender_entity_id, so the total is calculated separately for each sender.
Figure 9.245 Group by search: sender_entity_id
Step 5Add the filter: receiver_provider_country
Scroll to Filters (1). In the blank row open Field, type country and choose receiver_provider_country.
Figure 9.246 Filter row: the field search for country
Step 6Choose Not Equal
Open Operator.... For a text field the list is Equal, Not Equal, In, Not In, Contains, Not Contains, then (scroll) Starts With, Ends With, Is Null and Is Not Null. Choose Not Equal.
Figure 9.247 Filter operators for a text field: Not Equal
Step 7Compare with the sender’s country: Dynamic
Click Dynamic (1). The value box becomes Field..., a list of other fields. Type provider_country and choose sender_provider_country (2). A transaction is now counted only when the receiver’s provider country differs from the sender’s.
Step 8Set the time window: Days, 30 to 0, and save
Scroll down. Click Days (1); the default is Hours. Enter 30 in Analyze Transaction from and 0 in to (2): the 30 days up to the trigger time T. The filter row (3) reads receiver_provider_countryNot Equalsender_provider_country, Dynamic. Click Save Variable (4).
Figure 9.249 Time window 30 to 0 Days ago, the Dynamic filter and Save Variable
Step 9Find the variable in the list
The dialog closes and the variable is the first row of the Variables list, here VAR-08102026-000805.
Figure 9.250 Rule 15 variable in the Variables list
Step 10Check the saved variable
Click the row. View Variable shows the type tag NUM_AGG_SUM (1), the CREATED and UPDATED times and user (2), amount / Sum / sender_entity_id (3), 30 to 0 Days ago (4) and the saved Dynamic filter (5).
Figure 9.251 View Variable for crossborder_sum_30d
Part B: Create the typology
Fyscal ARCX→Transaction Monitoring→Typology→+ New
Step 11Fill in the details and choose High Value
Click + New on Typology. Type the name R17 Cross-border volume - PHP 1000000 or more sent abroad in 30 days (1). Set Suppression Window to 30 and choose Day (2): it matches the 30-day window. Write a description (3). Open Typology type (4), type HV01 and click High Value HV01.
Figure 9.252 Rule 15 details and the Typology type search
Step 12Choose the variable, operator and compare-to in row 1
In Group 1, click Select field, type part of the name and click crossborder_sum_30d. Choose Greater Than Equal and keep Static Value.
Figure 9.253 Rule 15 row 1: variable search
Step 13Enter 1000000 and go to the next step
Type 1000000 in Enter value. Check the name (1), the type chip High Value (HV01) (2), 30 Day (3), the description (4), Match AND (5) and the row (6). Click Next Step (7).
Figure 9.254 The completed Rule 15 page
Part C: Choose the schedule and save
Step 14Select the shared schedule and save the draft
On Review & schedule rule, open Select Schedule, search for schedule_2027, click it and click Save as Draft, as in Rule 7.
Step 15Check the saved draft
Wait a few seconds: the page becomes Update Typology (1) with the schedule (2), the run sentence (3), Update (4), Dry Run (5) and Activate (6). The screenshot shows the start in force when it was taken (01 Jan 2027).
Figure 9.255 Rule 15 after Save as Draft
Step 16Check the rule page
Open the rule from Transaction Monitoring → Typology. It shows Draft and the rule ID TMR-08102026-001139, created 08 Oct 2026, 06:42:04 pm (1); the summary with INTERVAL Every 1 day, SUPPRESSION 30Day and TYPOLOGY High Value (2); the condition, with the operator shown as Greater Than Equal (>=) (3); and the variable card crossborder_sum_30d, Num_agg_sum, WINDOW in last 30 day, GROUPsender_entity_id (4). The card does not show the variable’s filter; check it on View Variable.
Figure 9.256 The saved Rule 15 as a Draft, TMR-08102026-001139
How it evaluates. Sender A sent ₱700,000 to a receiver abroad and ₱400,000 to another receiver abroad: ₱1,100,000, alert. Sender B sent ₱3,000,000, all to receivers in the same country: the filter leaves nothing to add, no alert.
Dry-run result. In testing, the rule created 0 alerts at its real threshold (>= 1000000) in all four windows: no sender in the test data sent ₱1,000,000 abroad in 30 days. To prove the rule works, the threshold was lowered to >= 1 for one dry run. That created 991 alerts (276 / 278 / 282 / 155 by window, newest first), then the threshold was restored and a new dry run returned 0 again. See Test a typology with Dry Run for the method. The control also shows the filter at work: 991 alerts against 6,512 for the unfiltered 30-day total of Rule 3 at the same threshold.
Tuning. Set the amount from your cross-border risk appetite. Variant, not tested with Dry Run: to cover only some countries, use In on receiver_provider_country instead of the Dynamic compare (see proposal P1).
A dry run runs a saved draft against past records and reports how many alerts it would have created. Every rule in this chapter was dry-run on 08 Oct 2026; the results are in the Rule index.
Step 1Open the rule’s Review page
Open the saved draft, click Update, then Next Step. Review & schedule rule shows the card Dry run on historical records (1): “Test this rule against past data before going live. No alerts are created during a dry run.” Dry Run (2) is available once the rule is saved as a draft with a schedule; Activate (3) is next to Previous Step.
Figure 9.258 Review & schedule rule with the Dry run card (Rule 1)
Step 2Click Dry Run
Click Dry Run. No dialog or date choice appears. When the run finishes, the result opens in the card, Dry Run is replaced by Re-run and Hide Result (1), and the message “Dry run executed successfully” (2) appears at the bottom right.
Figure 9.259 The finished dry run: Re-run, Hide Result and the success message
Step 3Read the result
The top row (1) shows Time Windows, Records Scanned and Alert Created for the whole run. Below, one card per window (2) shows the window’s dates and its own Records Scanned and Alert Created. In the example the run tested 4 windows of one day each, the schedule’s interval, from 04 Oct 2026, 09:00 am to 08 Oct 2026, 09:00 am, newest first, and scanned 1,560 records. Rule 1 created 0 alerts. Re-run (3) runs it again.
Figure 9.260 Dry-run result for Rule 1: 4 windows, 1,560 records, 0 alerts
Step 4Compare with a rule that finds something
Rule 5 (fan-out) created 240 alerts (1), 60 in each window. Window 01 (2) scanned 0 records and still created 60 alerts: the window’s Records Scanned counts the records in that day, while the rule’s variable looks back 7 days. A rule with a 1-day variable, such as Rule 2, created alerts only in the windows that contained records.
Figure 9.261 Dry-run result for Rule 5: 240 alerts, 60 per window
Step 5Edit the rule: the dry run is erased
If you change the rule or its schedule and click Update, the dialog Update Typology says “Your dry run results would be erased once you update and save the rule again”. Click Update to save; the result is cleared and you run the dry run again. Until you confirm, the page waits behind the dialog, so look for it if Update seems to do nothing. While the form has unsaved changes, Re-run and Activate are greyed out.
Figure 9.262 Update Typology: Your dry run results would be erased
Judge the result: 0 is not proof
A result of 0 can mean that the data has no such pattern, or that the rule cannot read the data, for example because a field is empty. To tell them apart, run a positive control: lower the threshold so that any matching record would alert, check that alerts appear, then restore the threshold. The zero-alert rules in this chapter were all checked this way. Diagram 9.2 in Building blocks summarises the decision.
Step 6Lower the threshold for one run
In the rule, change the threshold to a value that must match if the data is read, here Greater Than Equal 1 instead of 3. Click Update, confirm the dialog, click Next Step and run Dry Run. Rule 1 created 4 alerts (1), so the variable, its filters and the condition work.
Figure 9.263 Positive control for Rule 1: threshold temporarily >= 1, 4 alerts
Step 7Restore the real threshold
Change the threshold back (here 3), click Update, confirm, and run the dry run again. It returns to 0 alerts (1). Do not request activation with the lowered threshold.
Figure 9.264 Rule 1 with the threshold restored to >= 3: 0 alerts
Tune a noisy rule
If a rule creates more alerts than your team can review, raise the threshold step by step and re-run.
Step 8Start from the first result
Rule 11 (many IP addresses) was first saved at 5 or more IP addresses in 7 days. The dry run created 758 alerts in four days of data, about 190 a day.
Figure 9.265 Rule 11 at >= 5: 758 alerts
Step 9Raise the threshold and re-run
At 10 the rule created 240 alerts. At 20 it created none. Each change needs Update, the confirmation and a new dry run.
Figure 9.266 Rule 11 at >= 10: 240 alerts
Step 10Settle on a value and rename the rule
At 15 the rule created 120 alerts, 30 a day (see Rule 11). The example was saved at 15 and its name and description were changed to say 15, so the name still describes the condition.
In Shadow Mode a rule runs on live data and its alerts are shown on the rule’s page, not sent to Alert Manager. Activation is a Maker Checker request: you (the maker) submit it, and a checker reviews it in Maker Checker Approval. While the request waits, the rule stays a Draft.
Step 1Click Activate and read the modes
On Review & schedule rule, click Activate. Activation Mode offers Shadow Mode (1), “Alert generated against live data will be shown in rule detail page.”, and Published Mode (2), “Alert from this rule will flow into Alert Manager.” Published is a separate mode and is not covered here. Activate (3) continues.
Figure 9.267 Activation Mode: Shadow Mode and Published Mode
Step 2Select Shadow Mode
Click the Shadow Mode card so that its radio button is filled (1), then click Activate (2).
Figure 9.268 Shadow Mode selected
Step 3Read the Submit Request dialog
Submit Request asks for a Reason (1), required, and optional Supporting Documents (2): 1 file, max 2 MB, .jpg, .jpeg, .jpe, .png, .pdf, .webp or .md, added with Attach File. Confirm (3) is greyed out until a reason is entered.
Figure 9.269 Submit Request: Reason, Supporting Documents and Confirm
Step 4Write the reason and confirm
Type a reason the checker can act on (1), for example the rule’s purpose, the dry-run result and “start in Shadow”. The example used a short test reason. Click Confirm (2).
Figure 9.270 Reason entered; Confirm available
Step 5Read the confirmation
The typology list opens and a message gives the request’s ticket ID: “Submitted for governance review (ticket AMLTM_…). It will be applied once approved.”
Figure 9.271 Submitted for governance review, with the ticket ID
Step 6Check the rule: it is still a Draft
Open the rule. It still shows Draft (1) and Activate (2): the request has not changed the rule. The EXECUTION PERIOD (3) starts at the schedule’s start, 09 Oct 2026, 09:00:00 am.
Figure 9.272 Rule 1 after the request: still Draft
Fyscal ARCX→Maker Checker Approval→Tickets
Step 7Find the request in Tickets
Go to Maker Checker Approval → Tickets. The request is the top row: Request ID 991, Activate Typology, status Pending, with the maker and the time it was created.
Figure 9.273 Tickets: the Activate Typology request, Pending
Step 8Open the ticket
Click ⋮ in Actions and choose View. (Watch is the other choice.)
Figure 9.274 The row’s Actions menu: View and Watch
Step 9Read the request
Request Details shows the request ID and Pending (1); the Domain Fyscal ARCX/Transaction Monitoring/Typology, the Action Activate Typology and Checker Progress 0 / 1 checkers acted (2); the Reason (3); and under Data Difference (4) the change requested: Activation Mode from - to shadow. Below, Additional Context gives the rule name and URL. Further down, the maker’s view has a Remarks box and Withdraw.
Figure 9.275 Request Details for an Activate Typology request
Every rule in this chapter was submitted for Shadow activation on 08 Oct 2026: 15 requests, numbers 991 to 1005. No checker acted on them, and by 11 Oct 2026 all 15 showed Expired, so the rules are still Draft. Rule 4 was rebuilt on 15 Oct 2026 as a new draft (see Rule 4). A request has to be approved before it expires; if it expires, submit a new one.
Figure 9.276 Tickets: the 15 Shadow requests for this chapter’s rules, all Pending
The settings each rule lets you change, and the ordinary activity that most often sets it off. The settings come from the rules above; the causes of false positives are general AML experience, not results from Fyscal ARCX. After each change, run a Dry Run and compare the alert count with the previous one.
Each proposal lists its variables and conditions, and the point to check first. Thresholds are placeholders for your own risk assessment.
P1 · Payments to high-risk countries · Proposed — not yet tested
Red flag
A sender pays receivers in countries your policy treats as high risk.
Variable
Count of id, grouped by sender_entity_id, 30 to 0 Days, filter receiver_provider_countryIn your list of countries
Condition
Variable Greater Than Equal (>=) 1
Check first
The format of receiver_provider_country values (for example two-letter codes or names) is not visible in the product, and the test data had no payments to the countries tried.
P2 · Pass-through account · Proposed — not yet tested
Red flag
Money received is sent on almost in full within a short time (layering).
Variables
A: Sum of amount, grouped by receiver_entity_id, 7 to 0 Days (received). B: Sum of amount, grouped by sender_entity_id, 7 to 0 Days (sent). For a faster pattern, use Hours as the unit.
Conditions
Match AND: A Greater Than Equal (>=) a minimum you choose, and B Greater Than Equal (>=) Variable A with THAN MULTIPLIER 0.9
Check first
Whether a typology that compares a variable grouped by receiver_entity_id with one grouped by sender_entity_id matches the same customer.
Many payments of exactly the same amount, which can indicate structured or scripted transfers.
Variables
A: Count of id, grouped by sender_entity_id, 7 to 0 Days. B: Count Distinct of amount, same grouping and window.
Conditions
Match AND: A Greater Than Equal (>=) 5, and B Less Than Equal 1
Check first
That Count Distinct on amount counts different amounts as expected. The typology type list includes “identical transactions”.
P4 · Jump in average payment size · Proposed — not yet tested
Red flag
A sender’s typical payment becomes much larger than their own usual size.
Variables
A: Average of amount, grouped by sender_entity_id, 7 to 0 Days. B: Average of amount, same grouping, 90 to 0 Days.
Condition
A Greater Than Equal (>=) Variable B with THAN MULTIPLIER 3
Check first
That the multiplier accepts values above 1 (only 0.5 has been tested). Customers with a short history can alert easily.
P5 · One device used by many customers · Proposed — not yet tested
Red flag
Several customers send from the same device, a common sign of accounts controlled by one person (money mules).
Variable
Count Distinct of sender_entity_id, grouped by sender_device_id, 7 to 0 Days
Condition
Variable Greater Than Equal (>=) 3
Check first
Which customer the alert is raised against when the variable is grouped by device rather than by customer.
P6 · One IP address used by many customers · Proposed — not yet tested
Red flag
Several customers send from the same network location.
Variable
Count Distinct of sender_entity_id, grouped by sender_ip, 7 to 0 Days
Condition
Variable Greater Than Equal (>=) a value set from a dry run
Check first
As P5. Shared networks (offices, mobile carriers) can put many legitimate customers behind one address.
P7 · Payments to merchant categories you treat as high risk · Proposed — not yet tested
Red flag
Spending with merchant types your policy flags, such as gambling or money services.
Variable
Count of id, grouped by sender_entity_id, 30 to 0 Days, filter merchant_category_codeIn your list of codes
Condition
Variable Greater Than Equal (>=) a value you choose
Check first
The format of merchant_category_code values in your data.
P8 · Activity above the customer’s declared profile · Proposed — not yet tested
Red flag
A customer sends far more in a month than the expected monthly spend recorded at onboarding.
Variables
A: an Entity variable on expected_monthly_spend. B: Sum of amount, grouped by sender_entity_id, 30 to 0 Days.
Condition
B Greater Than Equal (>=) Variable A with THAN MULTIPLIER 2
Check first
Whether an Entity variable can be compared with a Transaction variable in one typology, and on which customer key. The Entity field list includes expected_monthly_spend and expected_txn_frequency.
Data Ingestion shows how data reaches Fyscal ARCX, so administrators can check that each import ran and what it loaded. Batch Ingestion lists the scheduled import jobs for Customers, Accounts and Transactions files, lets you download source and error rows, and holds their schedule. Watchlist Ingestion lists the watchlist files loaded from LSEG and from the Internal Watchlist, and is where you upload your own Internal Watchlist file.
For
Administrators
In the menu
Fyscal ARCX → Data Ingestion
Reading time
About 14 min
Batch Ingestion: check each import job's records, skipped rows and status.
The Data Ingestion menu under Fyscal ARCX has two items: Batch Ingestion and Watchlist Ingestion. Transaction data comes in through Batch Ingestion as the Transactions file type.
Source CSV (Total Records) and error rows CSV (Skipped Rows)
Schedule
Up to 3 run times a day, set with Change Schedule
Check Batch Ingestion to confirm that customer, account and transaction files were imported, and to find the rows that were skipped. Batch Ingestion shows the ingestion schedule and a history of ingestion jobs. Each job imports one file type (Customers, Accounts or Transactions) and shows how many records it read, ingested and skipped.
Source fileCustomers, Accounts or Transactions
Ingestion jobOne job per file type, with a Job ID
ValidationJob statuses include Validating and Validated
Ingested or skippedEach row is counted in Ingested or Skipped Rows
Error rows CSVDownloaded from the Skipped Rows number
Diagram 10.1 — How a batch file is ingested
Diagram 10.1 follows one file through Batch Ingestion. A job reads the source file (Total Records), passes through validation, and loads the rows it can (Ingested). The rest are counted in Skipped Rows, and that number downloads them as an error rows CSV. The job's final status is shown in Status. See Investigate skipped rows.
Figure 10.1 Batch Ingestion: the schedule bar (1), Resume and Change Schedule (2), the filters (3), Refresh (4), the job list (5) and a linked count (6).
Schedule bar. Shows the schedule state (Inactive in the example), Current Frequency (Daily at 09:00), Next Run and Last Run. When there is no value, the screen shows a dash (-).
Resume and Change Schedule. Resume is shown next to Change Schedule while the schedule is Inactive. Change Schedule opens the Change Ingestion Schedule dialog (see Change the ingestion schedule).
Filters.Job Date (Pick a date range), File Type (All File Types) and Status (All Status). See Filter batch jobs.
Refresh reloads the job list.
Job list. One row per job, newest first. Below the list, Showing 1-20 of 113 gives the range and total, and Page 1 of 6 has first, previous, next and last page buttons.
Linked counts. Underlined numbers in Total Records and Skipped Rows are download links (see the column table below).
Column
What it shows
Format or example
Job Date / ID
When the job ran, with the job number below it after JOB ID:. A copy icon sits next to the job number.
14 Oct, 03:41:31 PM JOB ID: 268
File Type
The data the job imported, as a coloured tag.
Customers, Accounts, Transactions
Total Records
Records in the source file. When the value is above 0 it is an underlined blue link that downloads the source CSV.
1,037
Ingested
Records loaded. Plain text.
1,000
Skipped Rows
Rows not loaded. When the value is above 0 it is an underlined red link that downloads the error rows CSV.
34
Status
The job's status tag (see the status table below).
Completed
Duration
How long the job ran. A dash (-) is shown for the job in Validating status.
4s, 8m, 2m, -
Figure 10.2 Two job rows. In job 237 the Total Records value 100,037 (1) and the Skipped Rows value 34 (2) are links; job 238 found no files and has no links.
In most jobs, Ingested plus Skipped Rows equals Total Records: job 171 (Customers) shows 1,000 = 600 + 400, and job 173 (Accounts) shows 1,500 = 130 + 1,370. In some jobs the two counts add up to 3 less than Total Records. Job 237 (Transactions) shows 100,037 records, 100,000 ingested and 34 skipped (100,034). Earlier jobs 181, 136, 137 and 139 show the same gap of 3.
Job statuses
The Status filter lists ten job statuses, in this order. The screen does not describe them. Where a status appears in the example job list, the table says what that row shows.
Status
As seen in the job list
Init
Not seen in the example list.
Validating
Job 138 (Transactions): 0 records and a Duration of -.
Validated
Not seen in the example list.
Published
Not seen in the example list.
Ingesting
Not seen in the example list.
Completed
Most jobs. Can still have skipped rows, for example job 173 (Accounts): 1,500 records, 130 ingested, 1,370 skipped.
Partial Success
Not seen in the example list.
Failed
Jobs 166 and 167 (Customers): 0 records, 0s.
No Valid Record
Not seen in the example list.
No Files Found
Jobs 269 (Accounts), 270 (Transactions) and 238 (Customers): 0 records, 0s.
Use the three filters above the job list to narrow it by date, file type and status.
Step 1Filter by Job Date
Click Pick a date range (1) under Job Date. A two-month calendar opens, with arrows (2) to move back and forward a month. Click the first day, then the last day of the range.
Figure 10.3 The Job Date field (1) and its calendar, showing October and November 2026 with the month arrows (2).
Step 2Filter by File Type
Click All File Types (1) under File Type. The list has a search box (2) and three options (3): Customers, Accounts and Transactions. Click one.
Figure 10.4 The File Type filter (1), its search box (2) and the options Customers, Accounts and Transactions (3).
Step 3Filter by Status
Click All Status (1) under Status. The list has a search box and the ten statuses (2): Init, Validating, Validated, Published, Ingesting, Completed, Partial Success, Failed, No Valid Record and No Files Found. Scroll the list to see No Files Found. Click a status.
Figure 10.5 The Status filter (1): the statuses from Init to No Valid Record (2). No Files Found is further down the list.
Use these steps when a job did not load every row. Skipped rows are records that were not loaded, so the customers, accounts or transactions in them are missing from the platform until they are loaded.
Step 1Find jobs with skipped rows
On Batch Ingestion, narrow the list with Job Date and File Type if you need to (see Filter batch jobs). Look down the Skipped Rows column. A value above 0 is a red, underlined number, for example 34 on job 237 in Figure 10.2.
Step 2Download the error rows
Click the Skipped Rows number. The job's error rows CSV downloads. The number does not say that it is a download, and clicking the row itself does nothing.
Step 3Download the source file if you need it
Click the blue Total Records number to download the source CSV, so that you can compare the skipped rows with the file that was sent.
Step 4Have the data corrected
Pass the error rows to the team that produces the file, so that the records can be corrected and sent again.
Change the schedule when batch ingestion needs to run at a different frequency or at different times. Change Schedule opens the Change Ingestion Schedule dialog. Its subtitle reads: "Select the new frequency and run times, then review before confirming."
Figure 10.6 Change Ingestion Schedule: current frequency (1), New Frequency (2), Runtimes (3), the time field and Add time (4), Next Run Preview (5), and Cancel and Review Changes (6).
Current Frequency, with its time zone: Daily at 09:00 (UTC) in the example. Below it the dialog states: "Any schedule change — whether frequency, time, or timezone — takes effect after the next scheduled run on Fri, Oct 16, 2026, 09:00."
New Frequency: a drop-down, set to Daily in the example.
Runtimes - up to 3 per day: each run time is a chip (for example 09:00) with an × to remove it.
A time field (--:-- --) and + Add time, to add another run time.
Next Run Preview: the next run date and time (Fri, Oct 16, 2026, 09:00) and a summary, for example "Runs every day at 09:00 UTC."
Cancel closes the dialog. Review Changes moves on to review the change before confirming it.
Step 1Open the dialog
On Batch Ingestion, click Change Schedule.
Step 2Choose the frequency
Select a value in New Frequency.
Step 3Set the run times
To add a run time, enter it in the time field and click + Add time. To remove one, click the × on its chip. You can have up to 3 run times per day.
Step 4Check the preview and continue
Check Next Run Preview, then click Review Changes. To leave without changing the schedule, click Cancel or the × at the top right.
Check Watchlist Ingestion to confirm that watchlist files were loaded and to see any errors. Watchlist Ingestion lists each watchlist file loaded into the platform, with its source, status, start and end times and the number of rows processed. LSEG files appear in pairs named watchlist_delta__… and watchlist_deleted__…. Files you upload yourself appear with the source Internal Watchlist and names beginning internal_watchlist_delta__ or internal_watchlist_deleted__.
Watchlist filesLSEG delta and deleted files, or your Internal Watchlist upload
Watchlist IngestionStatus, Total Rows Processed and Error Message per file
WatchlistSearchable in Watchlist Search, Source LSEG or Internal Watchlist
Screening runsBatch and Delta Screening record a Watchlist Count
Diagram 10.2 — How watchlist data reaches screening
Diagram 10.2 shows the watchlist side. LSEG files and Internal Watchlist uploads are listed here, one row per file. Their records can be looked up in Watchlist Search, where the Source filter offers LSEG and Internal Watchlist, and each Batch Screening or Delta Screening run shows the Watchlist Count it recorded.
Figure 10.7 Watchlist Ingestion: search (1), Status (2) and Source (3) filters, Refresh (4), Upload Internal Watchlist (5), sortable columns (6), Error Message (7) and paging (8).
Use these controls to find a particular watchlist file, or to list only the files of one status or source.
Step 1Search by file name
Type part of a file name in Search by File Name.
Step 2Filter by status
Click All Status (1) and choose All Status, Success, In Progress or Failed (2). A tick marks the current choice.
Figure 10.8 The Status filter (1): All Status, Success, In Progress and Failed (2).
Step 3Filter by source
Click All Sources (1) and choose (2) All Sources, Internal Watchlist or LSEG.
Figure 10.9 The Source filter (1): All Sources, Internal Watchlist and LSEG (2).
Step 4Sort the list
Click a sortable column heading: Status, Start Time, End Time or Total Rows Processed. The ↑↓ icon on that column changes to an arrow showing the sort direction. In the example below, the list is sorted by Total Rows Processed, lowest first.
Figure 10.10 The list sorted by Total Rows Processed: the ascending arrow on the column heading (1) and the lowest values first (2).
Use this dialog when you need to add subjects to, or remove them from, your own Internal Watchlist. The Upload Internal Watchlist dialog does this using a CSV file. Its subtitle reads: "Add new subjects to the Internal Watchlist, or remove existing ones".
Figure 10.11 Upload Internal Watchlist: Add or Delete (1), the sample file (2), the upload area (3), and Cancel and Upload & Add (4).
Add to Internal Watchlist / Delete from Internal Watchlist: chooses whether the file adds or removes subjects. Add to Internal Watchlist is selected when the dialog opens.
The sample file internal_watchlist_add_sample.csv and Download Sample.
The upload area: "Click or drag file to this area to upload", "Only CSV format is supported", and Browse File.
Cancel and Upload & Add. Upload & Add is greyed out until a file is chosen.
Field or control
What it expects
Format
Add to Internal Watchlist / Delete from Internal Watchlist
Choose the action for the file.
Toggle; Add is selected by default.
Instructions (Add)
"Upload a CSV of customer records to add to the Internal Watchlist (Blacklist or Whitelist). Each row needs a UID, entity details, and a rationale. Review it against the sample file before uploading."
Text
Download Sample
Downloads the sample file internal_watchlist_add_sample.csv.
CSV
Upload area / Browse File
The file to upload. Drag it onto the area, click the area, or click Browse File.
"Only CSV format is supported"
Upload & Add
Uploads the chosen file.
Greyed out until a file is chosen.
Step 1Open the dialog
On Watchlist Ingestion, click + Upload Internal Watchlist.
Step 2Choose add or delete
Leave Add to Internal Watchlist selected to add subjects, or click Delete from Internal Watchlist to remove them.
Step 3Check your file against the sample
Click Download Sample and compare your CSV with it. For an add, each row needs a UID, entity details and a rationale.
Step 4Choose the file
Drag the CSV onto the upload area, or click Browse File and select it. Only CSV files are accepted.
Step 5Upload
Click Upload & Add. To leave without uploading, click Cancel.
Maker Checker Approval is where actions that need approval are set up and where the resulting requests are tracked. Administrators use Configs to define each activity that needs approval, with its SLA, warning point, approval count and the maker and checker permissions. Tickets lists the approval requests raised against those activities, so you can follow their status, review them and withdraw a request you raised.
For
Administrators
In the menu
Maker Checker Approval
Reading time
About 13 min
Configs: see which activities need approval and the rules set for each.
Use Configs to see which actions need approval and the approval rules for each. Configs lists every activity configuration. An activity names an action somewhere in the platform, for example AML Name Screening Config under Fyscal ARCX/Name Screening/Configuration/Screening, and sets the approval rules for it.
Figure 11.1 Configs: search (1), Create Activity (2), Show Filters (3), a UID (4), Status (5), the row menu (6) and paging (7).
Search by activity UID or name.
+ Create Activity opens the Create Activity form (see Create an activity).
Show Filters shows the Domain and Status filters; the button then reads Hide Filters.
UID: the activity's code, beginning ACT_, shortened with "…" and with a copy icon.
Use the row menu to change, inspect or deactivate an existing activity. Click ⋮ (1) in the Actions column of an activity. The Actions menu offers Edit (2), View (3) and Deactivate (4, in red).
Figure 11.4 The Actions menu (1) of an active activity: Edit (2), View (3) and Deactivate (4).
Action
What the screen shows
Edit
Opens the Edit Activity form, subtitled "Configure the approval flow, context queries, and permission gates for this MCA activity." It has the same fields as Create Activity (see Create an activity), with Close and Save. The activity's values are loaded: for AML Name Screening Config, the Domain (Fyscal ARCX/Name Screening/Configura…), SLA Duration (hrs) 24, Warning At (%) 75 and Approval Count 1. In that example Operation Point shows its placeholder, Select modal/screen.
View
Opens a window headed with the activity name and its full UID (for example AML Name Screening Config, ACT_dar2n8om2lbc73do21eg), with Close.
Deactivate
Shown in red in the menu.
Figure 11.5 View for AML Name Screening Config: the activity name and UID (1), the error Unable to load MCA config: insufficient scopes in the provided token (2), and Close (3).
Create an activity when an action in the platform needs to go through approval. + Create Activity opens the Create Activity form. The form scrolls: the top part sets the activity and its timing, and the lower part sets the context queries and permissions. Fields marked * are required.
Figure 11.6 Create Activity, top part: Activity Name (1), Domain (2), Operation Point (3), SLA Duration (hrs) (4), Warning At (%) (5), Approval Count (6) and Diff Fields (7).Figure 11.7 Create Activity, lower part: Context Type (1), Pre-validation Hook (2), Abort Hook (3), Maker Permission (4), Checker 1 Permission (5) and Save (6).
Field
What it expects
Required
Default, placeholder or options
Activity Name
Name of the activity.
Yes
Placeholder: e.g. Edit Email Template
Domain
The domain the activity belongs to.
Yes
Drop-down: Select Domain
Operation Point
The modal or screen the activity applies to. Has an info icon (ⓘ).
Yes
Drop-down: Select modal/screen
SLA Duration (hrs)
SLA in hours.
Yes
4
Warning At (%)
Warning point as a percentage.
No
80
Approval Count
Number of approvals. Has an info icon (ⓘ).
Yes
1
Diff Fields
Filled in by the form: "Select Domain and Operation Point above. All available diff fields from that modal will be auto-populated here".
No
Read-only until Domain and Operation Point are chosen
Use Tickets to follow approval requests and see where each one stands. A ticket is a request raised for an activity and waiting for approval. For example, activating a typology in Transaction Monitoring raises a ticket for the Activate Typology activity, with the domain Fyscal ARCX/Transaction Monitoring/Typology. Tickets lists these requests.
Raised by
The maker's action, for example Activate Typology
Decided by
A checker; the maker's view offers no approve or decline buttons
Progress
Checker Progress, for example 0 / 1 checkers acted
The maker can
View, Watch, and Withdraw a Pending ticket
Maker
Checker
System
Activates; picks the mode
Submits with a Reason
Raises a Pending ticket
Reviews the ticket
Approves or declines
Applies the change
Diagram 11.1 — Maker, checker and system steps for an Activate Typology request
Diagram 11.1 follows one request. The maker's steps and the system's response were seen on screen: after Submit Request the confirmation reads "Submitted for governance review (ticket AMLTM_…). It will be applied once approved.", the typology stays Draft, and a Pending ticket appears here with Checker Progress "0 / 1 checkers acted". The maker's side is described step by step in Request Shadow activation. While the ticket is Pending, the maker can withdraw it (see View a ticket).
Figure 11.8 Tickets: search by request ID (1), Show Filters (2), the request ID (3), the status (4) and the row menu (5); maker names hidden.
Search by request ID.
Show Filters shows the Domain, Activity Name, Maker and Status filters.
Ticket number, with a copy icon. The ticket's details and the confirmation message show a longer ticket ID beginning AMLTM_ instead (see View a ticket).
914
Activity ID
UID of the activity, shortened, with a copy icon.
ACT_D9LKNFJ1…
Activity Name
Name of the activity.
Activate Typology
Status
Ticket status tag.
Pending, Expired
Maker
The user who raised the request.
(user name)
Created At
When the ticket was raised.
Oct 6, 2026, 10:57:55 AM
Actions
Row menu (⋮).
View, Watch
Below the list, Page shows the current page number with previous and next buttons.
Use the search box and filters to find a ticket by request ID, domain, activity, maker or status. Click Show Filters. Four filters appear above the list, and the button reads Hide Filters.
Figure 11.9 Ticket search (1) and the Domain (2), Activity Name (3), Maker (4) and Status (5) filters, with Hide Filters (6).
Filter
Placeholder
Options
Search
Search by request ID
Free text
Domain
Select Domain
On Configs, the Domain filter lists No options found (Figure 11.2).
Activity Name
Select Activity
The activity names from Configs, for example AML Name Screening Config, Create Account Constraint, Add Role, Edit Role, Unfreeze Account
Use this table to look up a status shown on a ticket or in the Status filter. The Status filter lists eight ticket statuses. The screen does not describe them; the table notes what the example tickets show. Only Pending and Expired have been seen on tickets.
Status
As seen on screen
Pending
Tickets 991 to 1005 (Activate Typology, raised on 8 Oct 2026) while they waited, and ticket 914 when it was first seen on 6 Oct. The details show Checker Progress "0 / 1 checkers acted", and the maker can withdraw the ticket.
In Progress
Listed in the Status filter only.
Execution Pending
Listed in the Status filter only.
Approved
Listed in the Status filter only.
Declined
Listed in the Status filter only.
Withdrawn
Listed in the Status filter only.
Expired
Tickets 911 and 914, and tickets 991 to 1005 by 11 Oct (raised 8 Oct, no checker acted). Ticket 914 was Pending on 6 Oct, with "0 / 1 checkers acted", and Expired on 8 Oct. The tag is the same yellow as Pending.
Execution Failed
Listed in the Status filter only.
Pending
Checker approves
Approved
If the checker declines
Pending
Decline
Declined
If the maker withdraws
Pending
Withdraw
Withdrawn
Seen on ticket 914, with no checker action recorded
Pending
Expired
Diagram 11.2 — Ticket statuses and the paths out of Pending
Diagram 11.2 shows the paths a ticket can take out of Pending. Only Pending to Expired appears in this guide's screenshots (ticket 914, above). The other paths follow the actions on screen (Withdraw in the maker's view) and the status names in the filter (Approved, Declined, Withdrawn).
Open a ticket to review what was requested, the proposed change and any checker remarks, or to withdraw a request you raised. Click ⋮ in the Actions column of a ticket. The Actions menu offers View and Watch. View opens Request Details.
Figure 11.11 The ticket Actions menu (1): View (2) and Watch (3).Figure 11.12 Request Details for an Expired Activate Typology ticket, Maker Submission tab: request ID and status (1), created and requested by (2), domain, action and checker progress (3), tabs (4), reason and attachments (5), Data Difference (6), Additional Context (7) and Close (8).
Request ID, beginning AMLTM_ (shortened, with a copy icon), and the status tag. The Tickets list shows the same ticket by its number, here 1005.
CREATED date and time and REQUESTED BY with the maker's name (hidden here).
Reason given by the maker, and Attachments ("No attachments" when there are none).
Data Difference: a table of Field, Current Value and Proposed Value. In the example, Activation Mode changes from - to shadow.
Additional Context: a table of Field and Value, for example the Rule URL (a link to the rule, hidden here) and, further down, the Rule Name.
Close. While a ticket is Pending, its maker also sees a Remarks * box ("Required for withdrawal") and Withdraw here; once the ticket has expired they are no longer shown.
Figure 11.13 The Remarks tab (1): Request Decision (2), showing No checker remarks recorded for this request.
The Remarks tab shows Request Decision. When no checker has added remarks, it reads "No checker remarks recorded for this request." On a Pending ticket, the maker's Remarks * box and Withdraw stay at the bottom on both tabs.
Step 1Open the ticket
On Tickets, click ⋮ on the ticket, then View.
Step 2Review the request
On Maker Submission, read the Reason, Attachments, Data Difference and Additional Context. Click Remarks to see any checker remarks.
Step 3Withdraw your own request
If you raised the ticket, enter a reason in Remarks, which is required for withdrawal, then click Withdraw. To leave without changes, click the × at the top right.
Short answers to common questions about each module, the terms used in this guide, and how to contact Fyscal Technologies. Each answer links to the section of the guide that describes the screen.
Go to the Fyscal ARCX URL your institution has given you. On the Welcome back page, enter your Email and Password, then click Sign in. If you cannot sign in with your current password, click Forgot password?. See Signing in.
How do I change my password?
Click your name at the bottom of the sidebar and choose Change Password. On Verify Your Account, enter your registered email and current password, then click Continue to Password Change. The button is greyed out while the fields are empty. See Changing your password.
Where do I see my notifications?
Click the inbox icon at the top of the sidebar to open the Activity panel. It has All and Unread tabs, a Mark all read action and an Enable notifications switch. See Activity notifications.
Why can a colleague see options that I cannot?
Some pickers and actions depend on the permissions of the signed-in user, for example the people you can choose as an assignee and whether a button is available to you. Roles are defined per hierarchy in Case Manager → Config → Team Management; the AML hierarchy has four levels: AML Admin, AML Team Lead, AML Supervisor and AML Analyst. See Roles.
Overdue Alerts (Past SLA Threshold), Unassigned Alerts (Awaiting Assignment), Escalated Alerts and Escalated Cases (Pending Supervisor Review), and Pending Alerts and Pending Cases (Awaiting Review). To work the records behind a tile, open Case Manager → Alerts or Cases; the table in Metric tiles gives the filter or chip for each tile. For a short routine, see Daily triage from the dashboard.
How do I switch the charts between cases and alerts, or change the period?
Use the Cases / Alerts switch in the distribution panel header. Set the period with the presets Today, 7D, 30D, 3M, 6M and 1Y; the date range picker shows the period covered. See Case Distribution controls.
Why do some charts disappear when I switch views?
By Score and By Type appear only in the Alerts view. STR Filed and the Pending Review, Avg. Handling and Reopens tiles appear only in the Cases view. The metric tiles, Daily Jobs and Team Performance appear in both. See Dashboard layout.
How do I read the Daily Jobs grid?
Screening & Monitoring Runs has one row per job (Batch Screening, Delta Screening, TM Runs) and one column per day. A green dot with a multiplier and a figure in brackets marks Succeeded; a grey dot with a dash (—) means no status for that day. See Daily Jobs.
A case holds one or more alerts. Case Details shows an alert strip with one tab per alert, and each alert gets its own disposition through Dispose Alert. The case has its own Disposition in the case bar. See Case Details.
What statuses can a case have?
Eight: Not Started, Under Investigation, Pending Review, Escalated, STR Draft, STR Created, Closed and Reopened. The buttons in the case bar change with the status. See Case statuses and dispositions.
What do I need to dispose of an alert?
In the Dispose Alert dialog, choose a DISPOSITION (True Match, False Match or Potential Match), a Rationale Code, and enter Rationale Details of at least 10 characters. All three are required; Supporting Documents are optional. See Dispose alerts and close a case.
How do I review a case that is in Pending Review?
On All Cases, click the Pending Approval chip to list these cases. Open the case, read the request and decision card in the Pending Review panel, type your reasoning in Review Decision (required), then click Reject or Approve. See Review a case in Pending Review.
Can a closed case be reopened?
Yes. Cases in Closed, STR Draft and STR Created show ReOpen. Choose the alerts to reopen and enter a Reason for reopening (required). The case status becomes Reopened. See Reopen a case.
Where is the history of a case recorded?
Click Timeline & Notes. The Activity Timeline holds the case notes and a dated log of events (Created, Linked to Case, Disposition Submitted, Reopened), each with the user (or System) and the date and time. See Timeline and notes.
How do I tell a Name Screening alert from a Transaction Monitoring alert?
By the Module column, or by the alert ID: Name Screening IDs start with ALT-NS, Transaction Monitoring IDs with ALT-TMS. In a case's alert strip the tabs are labelled NS or TM. See Alerts list.
What does the SLA Deadline column show?
On Track (green) or Breached (red). On Alert Details the SLA Deadline shows a date and time, in red with (Breached) once missed. On All Alerts, the SLA Breached chip and the SLA filter narrow the list. For Name Screening, the SLA Deadline of each alert band is set in Alert Configuration. See Alerts list.
Why is Disposition greyed out on an alert?
On a Not Started alert, Disposition is greyed out and Start Investigation appears next to Timeline & Notes. On an alert that is Under Investigation and assigned, Disposition can be opened. On the unassigned example in this guide, Start Investigation is also greyed out. See Work an alert.
What are hibernated alerts?
The All Alerts filter bar has a Show Hibernated checkbox, unticked by default. Each Name Screening alert band has an Auto Hibernate setting (Yes or No) in Alert Configuration. See Alerts list and Alert Configuration.
Does generating an AI Summary have a cost?
The card states that generating a summary reads the alert and its matches, and costs one run against the daily limit. The summary is generated text; read it alongside the alert evidence. The disposition is recorded by the analyst. See Alert Details: Name Screening.
How do I put an alert into a case?
An alert that is Under Investigation and not in a case shows Group into Case at the right of the alert bar. From a case, you can bring ungrouped alerts in with Add Alerts. See Work an alert and Add alerts to a case.
In Case Creation & Assignment, Merge Alerts to a Case selects the alert types for case creation. Under Alert Type Grouping, the banner states: "Alert types in the same group will merge into a case based on customer ID, case age, and status." Each group sets its Alert Types, Case age and Case Status. See Case Creation & Assignment: Active Configuration.
How are new cases assigned?
Auto Assignment of Cases maps a Group to one or more people (Person) with a Method, for example Sequential. Click Edit, change the mapping, then click Save. See Edit the case creation configuration.
Can I see an earlier configuration?
Yes. The Configuration History tab lists every case creation configuration, newest first: one is ACTIVE, the rest INACTIVE. Click a row to open it read-only. See Configuration History.
How do I change the prompt behind Case Copilot or an AI Summary?
Open the prompt's card on Agentic Workflows → Prompt Config and click Edit. You can change Description, Task and Role; the Expected Response fields are not part of the form. Publishing creates a new version, as the banner states (for example "Editing from v2 · publishing creates v3"). See Edit and publish a prompt.
Why do I have to enter the Agent Key every time I update the model?
The Update model dialog states: "Saving publishes a new configuration and retires the current one. The API key cannot be read back, so enter it again." See Agentic Workflows: Model Config.
Type the customer's name or Customer ID in Search by Customer Name / ID. To narrow the list, click Show Filters and use KYC Level, Risk Tier or Country. See Search and filter the list.
Why don't the KYC Level filter options match the values in the list?
The filter offers Basic, Advanced, Enhanced, Complete and Full, while the KYC Level column shows values such as Kyc 0 and Kyc 1, and the Customer Profile shows values such as KYC L2. The screens do not show how they relate. See Search and filter the list.
Why are incoming and outgoing totals shown per currency?
On the Analytics tab, INCOMING and OUTGOING give one row per currency. Totals are not converted to a single currency. See Analytics tab.
Why are the transaction charts empty when the table lists transactions?
The Transaction Volume and Transaction Count charts cover the date range set above them, which can differ from the dates of the transactions in the table. Change the date range to chart a different period. See Transactions tab.
Where can I see a customer's earlier cases, screening runs and STRs?
No. STR Listing has no button to create an STR. An STR is filed from a case in Case Manager, with the File STR button. In this guide, File STR appears on cases that are Closed with the disposition True Match. See Where STRs come from and File an STR.
Can I edit a filed STR?
No. A filed STR opens read-only in a dialog with its six steps: values are shown in greyed fields and ticked or unticked boxes, and there is no save or submit button. See Open a filed STR.
What does the filing deadline next to the Date of determination mean?
The help text for Date of determination reads: "Date the covered person knew or should have known of the suspicious nature of the transaction. Starts the filing deadline clock." The message beside it gives the deadline worked out from that date, in red when overdue, for example Filing deadline: August 31, 2026 (Overdue by 44 days). See Step 2: Report Type.
How do I get an STR's file?
In the register, click the download icon in the Download CSV column of the STR's row. On a case whose STR has been filed (status STR Created), the case bar shows Download STR. See Search and filter the register.
Why does the total amount read "Mixed"?
When the included transactions are in different currencies, total amount (D-TD-6) is labelled Mixed. See Step 4: Transaction.
What is the difference between Watchlist Search and Manual Screening?
Watchlist Search looks up watchlist records by name and opens a record's details. Manual Screening screens one person or company from details you enter, and shows the weightage each field carries. See Watchlist Search and Manual Screening.
Can I screen a company as well as a person?
Yes. Entity Type on the Manual Screening form offers Individual and Company. Customer Name is the only required field. See Manual Screening.
How much does each field count towards the screening score?
The weightages are set in Screening Configuration. In the active configuration shown in this guide: Name 65% (Fuzzy 80%, Phonetic 20%), Address 10%, Citizenship 10%, Gender 10% and DOB 5%, a total of 100%. See Screening Configuration.
How are alerts banded by score?
Alert Configuration defines the bands, each with a Min % to Max % range, a No Alert setting, an SLA Deadline and an Auto Hibernate setting. In the active configuration shown: very low 0%–75% (No Alert: Yes), Low 75%–85%, Medium 85%–93% and HIGH 93%–100%. See Alert Configuration.
What is the difference between the Batch Screening and Delta Screening pages?
Both list screening runs with Customers Scanned, Alerts Created, Watchlist Count, Status and Duration. Batch Screening has no Change Schedule button; Delta Screening has Resume and Change Schedule, and shows the next scheduled run as Upcoming. See Batch Screening and Delta Screening.
Where does the watchlist data come from?
The Source filter in Watchlist Search offers Internal Watchlist and LSEG. Watchlist files are listed in Data Ingestion → Watchlist Ingestion, where you can also upload an Internal Watchlist file. See Watchlist Ingestion.
Under Transaction Monitoring in the sidebar, which expands into Typology, Variables and Schedules. Reference typologies are in the Typology Library. See Transaction Monitoring and Typology Library.
What happens when I activate a typology?
Click Activate on the rule's Review & schedule rule page. The Activation Mode dialog offers Shadow Mode ("Alert generated against live data will be shown in rule detail page.") and Published Mode ("Alert from this rule will flow into Alert Manager."). Choose a mode and click Activate; Submit Request then asks for a Reason (required). After Confirm, the message reads "Submitted for governance review (ticket …). It will be applied once approved." The request is an Activate Typology ticket in Maker Checker Approval, in the domain Fyscal ARCX/Transaction Monitoring/Typology, and the rule stays Draft until it is approved. See Request Shadow activation and View a ticket.
Does a dry run create alerts?
No. The Dry run card states: "Test this rule against past data before going live. No alerts are created during a dry run." The result shows, for each time window, the Records Scanned and Alert Created counts; it does not list the matching senders or transactions. See Test a typology with Dry Run.
Why does my condition "Equal 0" never match customers with no transactions?
When a customer has no transactions in a variable's window, the variable has no value for that customer: it is empty, not 0. A fixed number never matches it, and Is Null is not saved in a typology condition. Compare an amount with that variable through a large multiplier instead: an empty value counts as 0 when one variable is compared with another. See Building blocks and Rule 4 · Dormant account.
Why is Save as Draft greyed out?
Save as Draft stays disabled until you choose a schedule whose start time is in the future. See Before you build.
Why is my typology name rejected?
Typology names can contain only letters, digits, spaces, hyphens, underscores and parentheses, and must be 3 to 100 characters. Write amounts as "PHP 5000" rather than "₱5,000". See Before you build.
Why did my dry-run result disappear?
Changing a rule or its schedule and clicking Update opens the dialog "Your dry run results would be erased once you update and save the rule again". Confirming it clears the result; run the dry run again. While the form has unsaved changes, Re-run and Activate are greyed out. See Test a typology with Dry Run.
Why does a dry-run window with 0 records scanned show alerts?
A window's Records Scanned counts the records in that window only, while the rule's variables can look back further, for example 7 days. A rule with a 7-day variable can therefore alert in a window that has no records of its own. See Test a typology with Dry Run.
How do I see why a Transaction Monitoring alert was raised?
Open the alert and click the Rule Analysis tab. RULE TRIGGERED shows the rule name, the window and frequency, the number of breaches and each breached condition tagged Breach. See Transaction Monitoring evidence tabs.
How do I check that monitoring ran?
On the AML Dashboard, the TM Runs row of Daily Jobs shows the status of the monitoring job on each day. See Daily Jobs.
Each job imports one file type: Customers, Accounts or Transactions. Transaction data comes in through Batch Ingestion as the Transactions file type. See Batch Ingestion.
How do I see the rows that were not loaded?
When Skipped Rows is above 0, it is an underlined red link that downloads the error rows CSV. Total Records, when above 0, downloads the source CSV. A job with the status Completed can still have skipped rows. See Batch Ingestion.
What do the job statuses mean?
The Status filter lists ten statuses: Init, Validating, Validated, Published, Ingesting, Completed, Partial Success, Failed, No Valid Record and No Files Found. The screen does not describe them. See Batch Ingestion.
When does a schedule change take effect?
As the Change Ingestion Schedule dialog states, a change takes effect after the next scheduled run, not straight away. You can set up to 3 run times per day. See Change the ingestion schedule.
What file can I upload to the Internal Watchlist?
A CSV file only. Choose Add to Internal Watchlist or Delete from Internal Watchlist, and check your file against the sample from Download Sample. For an add, each row needs a UID, entity details and a rationale. See Upload an Internal Watchlist file.
What is the difference between Configs and Tickets?
Configs lists the activities that need approval and their rules. Tickets lists the approval requests raised against those activities. See Configs and Tickets.
What does an activity define?
Its name, Domain and Operation Point, the SLA Duration (hrs) (default 4), Warning At (%) (default 80), the Approval Count (default 1), the context queries, and the Maker Permission and Checker 1 Permission. See Create an activity.
Can I approve my own request?
No approve or decline buttons appear in the maker's view. When the maker opens their own ticket, the only action offered is Withdraw. See View a ticket.
How do I withdraw a request?
Open the ticket with View, enter a reason in Remarks, which is required for withdrawal, then click Withdraw. See View a ticket.
What ticket statuses are there?
The Status filter lists eight: Pending, In Progress, Execution Pending, Approved, Declined, Withdrawn, Expired and Execution Failed. The screen does not describe them. See Ticket statuses.
Terms used in this guide, in alphabetical order. Labels are spelled as they appear on screen.
Term
Definition
Activation Mode
The choice made when you click Activate on a typology: Shadow Mode, "Alert generated against live data will be shown in rule detail page.", or Published Mode, "Alert from this rule will flow into Alert Manager." The choice goes to a checker as an Activate Typology request, and the typology stays Draft while the request waits. See Request Shadow activation.
Activity
In Maker Checker Approval, a configuration that names an action somewhere in the platform and sets its approval rules: SLA, warning point, approval count, and maker and checker permissions. Activity codes begin ACT_. See Configs.
Activity Timeline
The panel opened by Timeline & Notes on a case or alert. It holds notes and a dated log of events, newest first. See Timeline and notes.
Agentic Workflows
The Case Manager Config page that holds the prompts (Prompt Config) and the model configuration (Model Config) used by Case Copilot and the AI Summary. See Agentic Workflows: Prompt Config.
Aggregation
The part of Create Variables where you set what a variable calculates: Field, Function and Group by, all required. See Create a variable.
AI Summary
A card on Alert Details that generates a summary of the alert: a verdict, rationale, findings and a recommended action, with the prompt version and model. Each generation costs one run against the daily limit. See Alert Details: Name Screening.
Alert
A single detection that needs review: one screening match or one rule breach. In Fyscal ARCX an alert is raised by Name Screening (ID starting ALT-NS) or Transaction Monitoring (ID starting ALT-TMS) and listed in Case Manager → Alerts. Alerts have six statuses. See Alerts list.
Alert band
A named score range in Name Screening Alert Configuration, with a colour, Min % and Max %, a No Alert setting, an SLA Deadline and an Auto Hibernate setting. The band and percentage appear as an alert's score, for example Low 75.76%. See Alert Configuration.
Alert Manager
A name shown in the Activation Mode dialog: in Published Mode, "Alert from this rule will flow into Alert Manager." No sidebar item is called Alert Manager. See Request Shadow activation.
AML
Anti-money laundering: the laws, controls and checks that stop criminal money being made to look legitimate. Fyscal ARCX is an AML platform for screening, monitoring, case work and reporting. See How Fyscal ARCX fits together.
AMLC
Anti-Money Laundering Council (Philippines). The STR wizard prepares a GoTRACS-compliant STR for the AMLC. See File an STR.
AND, OR (Match)
How conditions combine. Inside a group, Match AND means every row must be true ("AND — all must match"); OR means one true row is enough ("OR — any one matches"). Combine groups with does the same between groups. See Building blocks and How conditions are evaluated.
Approval Count
The number of approvals set on a Maker Checker activity. The default on the Create Activity form is 1. See Create an activity.
A Yes or No setting on each alert band in Alert Configuration. See Alert Configuration.
Average
A variable Function for numeric fields such as amount: the average value of the field over the window. See Create a variable.
Batch Ingestion
The Data Ingestion page that holds the ingestion schedule and lists the import jobs for Customers, Accounts and Transactions files. See Batch Ingestion.
Batch Screening
The Name Screening page that lists the batch screening runs, with customers scanned, alerts created, errors, watchlist count, status and duration for each run. See Batch Screening.
Beneficiary
The person or organisation that receives the funds or the benefit of a transaction. In an STR, party role B. See Step 4: Transaction.
Between, Not Between
Filter operators for number fields: the value falls inside, or outside, a range you give. Rule 1 uses two amount filters to set its band instead. See Building blocks.
BSP
Bangko Sentral ng Pilipinas. The STR Institution code is described on screen as an "18-digit code assigned by AMLC/BSP". See Step 2: Report Type.
Case
A record in Case Manager → Cases that holds one or more alerts for a customer, with its own status, assignee and disposition. Case IDs look like CASE-2026-0034617. See Case Details.
Case Copilot
An AI Investigation Assistant: a chat panel on Case Details that answers questions about the open case, from prompts such as Summarize case or Explain match scores. Check its answers against the case. See Case Copilot.
Case Origin
How a case was created: Manual or Automated. See Cases list.
Checker
The second person in a Maker Checker request: the user who approves or declines it. An activity sets the Checker 1 Permission and the Approval Count, and a ticket shows Checker Progress, for example "0 / 1 checkers acted". No approve or decline buttons appear in the maker's view of their own ticket, which offers only Withdraw. See View a ticket.
Condition
One row of a typology group: WHEN a variable, an operator, and a Static Value or another Variable to compare with. A variable only calculates a value; the condition decides whether that value is suspicious. See Create Typology form.
Config version
The unique ID of a saved configuration. Saved configurations are listed in a history tab, where one is ACTIVE and the rest INACTIVE. See Configuration History.
Count
A variable Function that counts the transactions in the window, for example Count of id per sender (Rule 1). See Create a variable.
Count Distinct
A variable Function that counts the different values of a field, for example the different receivers a sender paid (Count Distinct of receiver_entity_id, Rule 5). See Rule 5 · Fan-out.
Counterparty
The other party to a customer's transaction: the receiver when the customer sends, the sender when the customer receives. Customer 360 shows the top counterparties; in an STR, party role C. See Analytics tab.
Covered person
In Philippine AML rules, an institution such as a bank that must report suspicious transactions to the AMLC. The phrase appears in the help text of Date of determination. See Step 2: Report Type.
Cross-border
A transaction between parties in different countries. Rule 15 adds up what a sender sent to a country other than their own in the last 30 days. See Rule 15 · Cross-border volume.
Customer 360
The module that lists customers and opens a Customer Profile for each: identity and KYC details, accounts, analytics, transactions, prior cases and alerts, screening history and STR history. See The customer list.
Customer due diligence (CDD)
The checks an institution makes on a customer: who they are, their risk rating, whether they are a PEP, their income and source of funds, and how much and how often they expect to transact. Customer 360 shows these details. See The Customer Profile.
Daily Jobs
The AML Dashboard panel that shows the outcome of the platform's scheduled jobs: Screening & Monitoring Runs and Data Ingestion. See Daily Jobs.
Data Difference
The table on a Maker Checker ticket that shows each changed Field with its Current Value and Proposed Value. See View a ticket.
Date of determination
An STR field, described on screen as the "Date the covered person knew or should have known of the suspicious nature of the transaction. Starts the filing deadline clock." See Step 2: Report Type.
Delta Screening
The Name Screening page that shows the delta screening schedule and lists its runs, including the next scheduled run. Its schedule can be changed with Change Schedule. See Delta Screening.
Device, IP address
The device and network address a payment was made from, held in the transaction fields sender_device_id and sender_ip. Rules 10 and 11 count how many a sender uses; proposals P5 and P6 count how many customers share one. See Rule 10 · Many devices and Rule 11 · Many IP addresses.
Disposition
The outcome recorded for an alert or a case: True Match, False Match or Potential Match. Lists show - until one is recorded. See Case statuses and dispositions.
Dormant account
An account with no activity for a long period. A sudden payment after a quiet spell is a common red flag; Rule 4 looks for no transactions from 100 to 1 days ago, then a payment in the last day. See Rule 4 · Dormant account.
Draft
A typology status: the rule is saved but not activated. New typologies are saved as Draft, and a rule stays Draft while its activation request is Pending. Dry Run works on a saved draft. See Typology list.
Dry Run
A test of a saved draft typology against past records, started with Dry Run on the Review & schedule rule page. "No alerts are created during a dry run." The result gives Records Scanned and Alert Created for each time window, without listing the matches, and is erased when the rule is updated. See Test a typology with Dry Run.
Duplicate
Makes a copy of a typology (the Actions menu of a Draft rule, or Duplicate Typology on its page) or of a variable. A variable used in a live rule cannot be edited: duplicate it and change the copy. See View Variable.
Enhanced due diligence (EDD)
Extra checks applied to customers an institution rates as higher risk, such as PEPs: more information on the source of funds and closer review of their activity.
Entity
In Create Variables, the Transaction and Entity tabs choose whether a variable is calculated from transactions (the default) or from entity data. In the Rule index, Entity is the field a rule's variables are grouped by: sender or receiver. See Create a variable.
Escalated
A status of cases and alerts. In AML work, escalation passes an alert or case to a more senior reviewer. The dashboard tiles Escalated Alerts and Escalated Cases carry the sub-label Pending Supervisor Review, and All Alerts and All Cases each have an Escalated chip. See Case statuses and dispositions.
Execution Interval
How often a Transaction Monitoring schedule runs: a number and a unit, for example every 1 day. See Schedules: Schedule List.
Expired
A Maker Checker ticket status. The activation requests made for this guide expired with no checker action, and their rules stayed Draft: a request has to be approved before it expires, and an expired one needs a new request. See Ticket statuses.
False Match
A disposition value. For an alert it is chosen in the Dispose Alert dialog, together with a required Rationale Code and Rationale Details; a case has its own Disposition in the case bar. The other values are True Match and Potential Match. See Dispose alerts and close a case.
False negative
Suspicious activity that a rule or screening check does not alert on. Raising thresholds cuts false positives but can create false negatives, which is why changes are tested first.
False positive
An alert that turns out, on review, not to be suspicious or not to be the listed party. Many false positives usually mean a rule needs tuning. See Tuning and false positives.
Fan-in
Many different senders paying one receiver, a pattern typical of money-mule and pooling accounts. See Rule 6 · Fan-in.
Fan-out
One sender paying many different receivers, for example to spread funds quickly. See Rule 5 · Fan-out.
Field
In Create Variables, the transaction field a variable calculates on, for example amount, id or receiver_entity_id. The field decides which functions are offered. See Create a variable.
Filters
Optional rows in Create Variables (field · operator · value) that limit a variable to matching transactions. Rows combine as "AND — all must match". See Create a variable.
Financial intelligence unit (FIU)
The national agency that receives and analyses suspicious transaction reports. STRs in this guide are prepared for the AMLC. See File an STR.
Four-eyes principle
A control in which one person proposes or decides and a different person checks and approves. Maker Checker Approval and the review of a case in Pending Review apply it. See Configs.
FT AML
The breadcrumb shown at the top of the Transaction Monitoring screens (typologies, variables and schedules). It is a label on those screens, not a separate module: you reach them from Fyscal ARCX → Transaction Monitoring in the sidebar. See Typology list.
Function
In Create Variables, the calculation: Count, Count Distinct, Sum, Average, Minimum or Maximum. Numeric fields offer all six; text and ID fields offer only Count, Count Distinct, Minimum and Maximum. See Building blocks.
Fuzzy, Phonetic
The two sub-fields of Name in Screening Configuration, each with its own weightage (Fuzzy 80% and Phonetic 20% in the configuration shown). See Screening Configuration.
GoTRACS
The AMLC reporting format the STR wizard follows ("GoTRACS-compliant STR filing for AMLC"). Codes after STR field names, such as H-3 or D-SD-2, are the GoTRACS field references shown on screen. See File an STR.
Greater Than Equal (>=)
The condition operator most rules in this guide use: the variable is equal to or above the threshold, for example ≥ 10 receivers. See Create Typology form.
Group by
The field a variable is calculated per: sender_entity_id gives one result per sender, receiver_entity_id one per receiver. See Create a variable.
Hibernated
Alerts shown when the Show Hibernated checkbox on All Alerts is ticked. Alert bands carry an Auto Hibernate setting. See Alerts list.
Hierarchy
A template in Team Management that defines an organisational structure as levels of roles with members. The AML hierarchy has the levels AML Admin, AML Team Lead, AML Supervisor and AML Analyst. Status: Active, Inactive or Removed. See Team Management: the hierarchy list.
High value
A large total moved in a period. Rule 3 adds up what a sender sent in the last 30 days; High Value (HV01) is also a typology type. See Rule 3 · High value.
High-risk country
A country (jurisdiction) an institution's policy treats as higher risk for money laundering or terrorist financing. Proposal P1 looks for payments to such countries. See Proposed typologies.
In, Not In
Operators that compare a field with a list of values. Type each value and press Enter. See Building blocks.
Ingestion
Loading data files into the platform: customer, account and transaction files in Batch Ingestion, and watchlist files in Watchlist Ingestion. Each job shows its total, ingested and skipped rows. See Batch Ingestion.
Instrument
The card or account a payment is paid from, held in the field sender_instrument_id. Rule 12 counts the different instruments a sender used in 7 days. See Rule 12 · Many instruments.
Internal Watchlist
A watchlist source alongside LSEG. You add subjects to it, or remove them, by uploading a CSV file in Watchlist Ingestion. See Upload an Internal Watchlist file.
Is Null, Is Not Null
Operators in the operator lists that test whether a value is empty. In a typology condition they are not saved with the rule, so do not rely on them. To test for "no transactions", see Building blocks.
KYC
Know Your Customer: checking who a customer is and understanding the business they expect to do. Customer 360 shows a KYC Level in the customer list (for example Kyc 0, Kyc 1) and KYC on the Customer Profile (for example L2). See The Customer Profile.
Large single transaction
One very large payment. Rule 7 takes the sender's largest single amount in the last day; Large Transaction (LT-01) is also a typology type. See Rule 7 · Large single transaction.
Layering
The stage of money laundering that moves funds through many transactions or accounts to hide where they came from. Layering is also a typology type; proposal P2 (pass-through account) looks for it. See Proposed typologies.
Live Alerts, Shadow Alerts
Columns of the Transaction Monitoring Run History: the alerts raised in a run by Published rules (Live) and by Shadow rules. See Schedules: Run History.
Look-back
Another name for a variable's window: the period counted back from the trigger time T. See Building blocks.
LSEG
A watchlist source. LSEG files appear in Watchlist Ingestion in pairs named watchlist_delta__… and watchlist_deleted__…. See Watchlist Ingestion.
Maker
The user who raises a Maker Checker request, for example by submitting an Activate Typology request with a Reason. An activity sets the Maker Permission. The maker can Withdraw their own pending ticket, with a remark, but has no approve or decline buttons. See Tickets and View a ticket.
Maker Checker Approval
The sidebar item that holds the activities that need approval (Configs) and the approval requests raised against them (Tickets). See Maker Checker Approval.
Manual Screening
The Name Screening page where you enter one person's or company's details and screen them on demand. See Manual Screening.
Match Score
A row of the Matches panel on a Name Screening alert or case. Each watchlist candidate shows its score band and percentage (for example LOW 87.94%), and each field its own Weightage and Score. See Customer, accounts and matches.
Matches
The area of a Name Screening alert that compares the customer with each watchlist candidate, field by field, with the weightage and score of each field. See Customer, accounts and matches.
Merchant category code
A code for a merchant's type of business, held in the transaction field merchant_category_code. Proposal P7 looks for payments to categories your policy treats as high risk. See Proposed typologies.
Minimum, Maximum
Variable functions: the smallest or largest value of a field in the window. Rule 7 uses Maximum of amount to find the largest single payment. See Rule 7 · Large single transaction.
Money mule
A person whose account is used to receive and pass on criminal money, knowingly or not. Fan-in, many devices on one account, and one device used by many customers are typical signs. See Rule 6 · Fan-in.
Name Screening
Checking customer names against watchlists of sanctioned parties, PEPs and other names of concern. In Fyscal ARCX, the module that runs batch, delta and manual screening and sets alert bands and weightages. See Name Screening.
Operator
The comparison in a filter or condition. Number fields offer Equal, Not Equal, Greater Than, Greater Than Equal, Less Than, Less Than Equal, Between, Not Between, In and Not In; text fields also offer Contains, Starts With, Ends With, Is Null and Is Not Null. See Building blocks.
Party role
The letter shown against each sender and receiver in an STR: S Subject of Suspicion, B Beneficiary, C Counterparty, T Transactor, O Other participant. See Step 4: Transaction.
Pass-through account
An account where money received is sent on almost in full within a short time, a sign of layering. Proposal P2 describes a rule for it. See Proposed typologies.
Paused
A chip beside a typology's status on its page: the rule is not currently running, and the page offers Resume. See Typology list.
A check used in this guide when a dry run returns 0 alerts: lower the threshold so that any matching record would alert, confirm that alerts appear, then restore the real threshold. It shows whether 0 means "no such pattern" or "the rule cannot read the data". See Test a typology with Dry Run.
Potential Match
A disposition value, chosen in the same places as True Match and False Match. In general use it means the evidence is not enough to confirm or rule out the match. See Dispose alerts and close a case.
Predicate crime
A crime that produces the money being laundered, such as fraud, drug trafficking or corruption. STR step 3 lists Predicate crimes — PC1-PC36. See Step 3: Reason for suspicion.
Published, Published Mode
Used in three places. A typology status: the rule was activated in Published Mode, "Alert from this rule will flow into Alert Manager." In Agentic Workflows, publishing a prompt creates a new version, and saving a model configuration "publishes a new configuration and retires the current one". In Batch Ingestion, Published is one of the ten job statuses, which the screen does not describe. See Typology list, Edit and publish a prompt and Batch Ingestion.
Rationale code
The coded reason for a disposition, chosen from a dropdown in the Dispose Alert dialog, for example "Identification number of the user is the same as the watchlist". It is required, together with Rationale Details of at least 10 characters. See Dispose alerts and close a case.
Reason for suspicion codes
The codes chosen in step 3 of an STR: Suspicious circumstances SC1–SC6, Predicate crimes PC1–PC36 and Transnational organized crime MC1. See Step 3: Reason for suspicion.
Records Scanned
In a Dry Run result and in a rule's run history, the number of records the run read. 0 means there was no transaction data in the window: check data ingestion for that period before judging the rule. See Schedule Details.
Red flag
A sign that activity may be suspicious and worth a closer look. Each Typology Library rule opens with the red flag it looks for. See Rule index.
Risk Level, RISK
The customer's risk rating. The customer list shows Risk Level as a coloured tag; the Customer Profile and the case customer card show RISK as a tier with a number in brackets, for example HIGH (77). See The Customer Profile.
Risk-based approach
Setting controls in proportion to risk: more checks and lower thresholds for higher-risk customers, products and countries. The Typology Library's thresholds are starting values to set from your own risk assessment.
Rule Analysis
The tab on a Transaction Monitoring alert that shows the rule triggered, its window and frequency, the number of breaches and each breached condition. See Transaction Monitoring evidence tabs.
Sanctions
Legal restrictions on dealing with named people, organisations, vessels or countries. Sanctioned parties appear on watchlists and are what name screening looks for. See Watchlist Search.
Save as Draft
Saves a new typology with the status Draft, on the page after the conditions. It needs a schedule, and the page then becomes Update Typology. See Part 6: Save as draft.
Schedule
When a recurring job runs, shown as Current Frequency, Next Run and Last Run on Batch Ingestion, Batch Screening and Delta Screening. A schedule change takes effect after the next scheduled run. In Transaction Monitoring, a schedule has a name, an Execution Interval, a start time and an optional end time, and one schedule can drive several rules. See Change the ingestion schedule and Schedules: Schedule List.
Screening Configuration
The Name Screening page that holds the weightages of the screening fields (Name, Address, Citizenship, Gender, DOB) and their sub-fields. See Screening Configuration.
SEGMENT
A tag on the Customer Profile and the case customer card that gives the customer's segment, for example Retail. See The Customer Profile.
Shadow, Shadow Mode
A typology status and Activation Mode. In Shadow Mode, "Alert generated against live data will be shown in rule detail page": the rule runs on live data and its alerts appear on the rule's page rather than flowing into Alert Manager. In the Activate Typology ticket, Data Difference shows Activation Mode changing from - to shadow. See Typology list and Request Shadow activation.
Skipped Rows
The rows of a Batch Ingestion file that were not loaded. When above 0, the number is a link that downloads the error rows CSV. See Batch Ingestion.
SLA
Service level agreement. Alerts show an SLA Deadline (On Track or Breached); each alert band sets an SLA Deadline in days, hours and minutes; each Maker Checker activity sets an SLA in hours. See Alerts list.
Smurfing
Many very small payments, often made by several people, that together move a large amount. Rule 8 counts a sender's transactions under ₱1,000 in the last day. See Rule 8 · Smurfing.
Spike
A sudden rise against a customer's own history. Rule 9 compares the sender's 7-day total with their 90-day total. See Rule 9 · Spike against own history.
Static, Dynamic
On a filter row, Static compares the field with a value you type; Dynamic compares it with another field. In a condition the choice is Static Value or Variable. See Building blocks.
Status (case)
One of eight values: Not Started, Under Investigation, Pending Review, Escalated, STR Draft, STR Created, Closed, Reopened. Alerts use the same values except STR Draft and STR Created. See Case statuses and dispositions.
STR
Suspicious Transaction Report. Prepared from a case in Case Manager with the six-step STR wizard, "GoTRACS-compliant STR filing for AMLC". Cases with an STR show the status STR Draft or STR Created, and a filed report is listed, read-only, in STR Listing. See File an STR and The STR register.
STR Type
The type of report chosen in step 2 of an STR: STRR (Regular STR), STRA (Per Account), STRHP (High Priority), STRHU (Highly unusual) or STRBR (Bulk Report). See Step 2: Report Type.
Structuring
Splitting money into several amounts that each stay below a level that would draw attention. Rule 1 counts a sender's transactions in a band just below an amount you review. See Rule 1 · Structuring.
Subject of Suspicion
The person or organisation whose activity the STR is about. In an STR, party role S. See Step 4: Transaction.
Subject parties
Step 5 of an STR: the parties auto-derived from the selected transactions, each with a party role and identity details. See Step 5: Subject parties.
Sum
A variable Function for numeric fields: the total of the field over the window, for example the amount a sender sent in 30 days (Rule 3). See Create a variable.
Suppression Window
A setting on a typology: a number (default 0) and a unit such as Hour or Day, for example 7 Day. An information icon (ⓘ) next to the label holds the field's help text. See Create Typology form.
In a condition that compares with another Variable, the factor applied to that variable: 0.5 means "at least half of it" (Rule 9). See Create Typology form.
Threshold
The value a condition compares a variable with, for example ≥ 10 receivers. Set it from your own risk assessment and check it with a Dry Run. See Tuning and false positives.
Ticket
A request raised for a Maker Checker activity and waiting for approval, identified by a Request ID (the ticket details show a longer ID beginning AMLTM_). A ticket starts as Pending; the Status filter lists eight statuses. See Tickets and Ticket statuses.
Time Window
The period a variable covers, set as a unit (Hours, Days, Weeks, Months or Years) and a range "Analyze Transaction from X to Y … ago". The range can end before now: 100 to 1 Days covers the 100 days up to yesterday. See Building blocks.
Transaction Monitoring
Checking customers' transactions for patterns that may be suspicious. In Fyscal ARCX, the module that holds the typologies, variables and schedules and raises alerts with IDs starting ALT-TMS. See Transaction Monitoring.
Transactor
The person who carries out a transaction, who may differ from the account holder. In an STR, party role T. See Step 4: Transaction.
Transnational organized crime
Serious crime planned or carried out across borders by organised groups. STR step 3 lists it as code MC1. See Step 3: Reason for suspicion.
Trigger time (T)
The time a rule's run starts. Variable windows are counted back from it; the form reads "This variable will be triggered time 00:00:00 on day T." See Building blocks.
True Match
A disposition value, chosen in the same places as False Match and Potential Match. In this guide, a case that is Closed with the disposition True Match shows File STR. See File an STR.
Tuning
Adjusting a rule's thresholds, windows, filters and Suppression Window so that it raises useful alerts. Run a Dry Run after each change. See Tuning and false positives.
Typology
A known pattern of money-laundering or terrorist-financing behaviour. In Fyscal ARCX, a Transaction Monitoring rule that looks for one, with an ID starting TMR-. It holds one or more conditions on variables, a typology type, a suppression window and a schedule, and has the status Draft, Shadow or Published. New typologies are saved as Draft and are activated through a Maker Checker request. The Typology Library gives tested examples. See Typology list and Typology Library.
Typology type
The category chosen for a typology on the Create Typology form, for example Structuring (TP100), Velocity (V-01) or Anomaly (TP103). The list shows No category when none was chosen. See Building blocks.
UID
A unique identifier. Watchlist records have a UID (for example 3601955), and so do Maker Checker activities (codes beginning ACT_). See Watchlist Search.
UTC
Coordinated Universal Time. Schedule run times in the Change Screening Schedule and Change Ingestion Schedule dialogs are given in UTC. See Delta Screening.
Variable
A named calculation with an ID starting VAR-, such as the number of transactions a sender made in the last 7 days. It is set by a Field, a Function (for example Count or Sum), a Group by field, a Time Window and optional Filters. Typology conditions test variables, and one variable can be used by many typologies. When a customer has no records in the window, the value is empty, not 0. See Variables list and Building blocks.
Velocity
Many transactions in a short time. Rule 2 counts a sender's transactions in the last day; Velocity (V-01) is also a typology type. See Rule 2 · Velocity.
Watchlist
The records that names are screened against, from the sources LSEG and Internal Watchlist. Each record has a UID, name, PEP status, country, category and date of birth. See Watchlist Search.
Watchlist Ingestion
The Data Ingestion page that lists each watchlist file loaded into the platform, with its source, status and rows processed. See Watchlist Ingestion.
Weightage
The share a screening field or sub-field carries, set in Screening Configuration. The field weightages add up to 100%. Manual Screening shows the weightage next to each field. See Screening Configuration.
Withdraw
The action in the maker's view of their own Pending ticket that withdraws the request; Remarks is required. See View a ticket.
Transaction charts are empty but the table lists transactions
Change the date range above the charts to the period of the transactions. See Transactions tab.
Save as Draft is greyed out on a typology
Choose a schedule whose start time is in the future. See Before you build.
Update seems to do nothing on a typology that has a dry-run result
Look for the Update Typology dialog ("Your dry run results would be erased …") and confirm it. See Test a typology with Dry Run.
Unable to load MCA config, with "insufficient scopes in the provided token"
The message appears in an activity's View window and in the Diff Fields box of Edit. Contact support with the activity name and UID. See Activity actions.
New: Customer Risk Profile (CRP). Risk Score Configuration and Score Configuration under Customers: choose the customer attributes to score, give each value a score from 0 to 100, weight the attributes up to 100% in total, set the Low, Medium and High score bands, and activate versions from a draft, with a full configuration history. Each customer's score and its breakdown appear on the new Customer Risk Score tab of the Customer Profile. See Customer risk profile.
New: Typology Library. Fifteen example typologies built in Transaction Monitoring, each with its variables and conditions, a dry-run result and a Shadow activation request, plus how to test a rule with Dry Run and request Shadow activation through Maker Checker Approval. See Typology Library.
New: AML Dashboard. Six metric tiles (Overdue, Unassigned, Escalated and Pending alerts; Pending and Escalated cases), case and alert distribution by status, disposition, score, type, assignment and age, an STR Filed chart, and a Daily Jobs grid for Batch Screening, Delta Screening, TM Runs and Data Ingestion. See AML Dashboard.
New: Maker Checker Approval: Tickets. Approval requests, such as Activate Typology, are listed as tickets with a request view (Maker Submission and Remarks tabs). The Status filter lists eight statuses: Pending, In Progress, Execution Pending, Approved, Declined, Withdrawn, Expired and Execution Failed. Activity configurations are under Configs. See Tickets.
New: Team Management. Hierarchy templates under Case Manager → Config, with a Template Builder and a Hierarchy Builder. The AML hierarchy has the levels AML Admin, AML Team Lead, AML Supervisor and AML Analyst. See Team Management.
New: Pending Review on cases. A case awaiting review shows a Pending Review panel with Review Decision, Approve and Reject. See Review a case in Pending Review.
New: Upload Internal Watchlist. Add subjects to, or delete them from, the Internal Watchlist by uploading a CSV file from Watchlist Ingestion. See Upload an Internal Watchlist file.
New: AI Summary and Agentic Workflows. Alerts can generate an AI Summary on request. Agentic Workflows has Prompt Config, with prompt revisions, and Model Config, with previous configurations. See Agentic Workflows.
New: Typology run history and Schedules. Schedule Details shows each typology's run history, and Schedules has Run History and Schedule List views. See Schedule Details.
New: Watchlist Entity Details. Opening a Watchlist Search result shows the entity in four tabs: Profile & Identity, Risk & Background, Network & Locations and Source. See Watchlist Entity Details.